Claude Code's Auto Mode Approved the Malware. Then It Blocked the Command to Kill It.

A published attack chain against Claude Code Opus 5 shows the permission classifier failing in the one direction nobody plans for. Anthropic's own permission docs still list auto mode's isolation requirement as "None."

There is one screenshot in Johann Rehberger's August 26 write-up that is worse than the exploit it belongs to. By that point Claude Code has already been compromised. It has noticed. It proposes a command to terminate the process it started by accident, and auto mode denies the command.

Rehberger gives that moment its own section heading, "Auto Mode Blocks Cleanup!", and one sentence that should be pinned above every agent deployment thread this year: "The classifier allowed the creation of the malware process, but then it blocked the command intended to stop it!"

Read that as a design fact rather than a bug report. A permission classifier that misses an attack has a coverage gap, and coverage gaps are normal. A permission classifier that misses the attack and then blocks the remediation has something else going on. It is scoring the shape of individual commands, and a command that kills a process looks more alarming in isolation than a short Python script that decodes a file. The control ran correctly both times. It was just never asked the question anyone cares about.

What the classifier actually saw

The chain starts with the most boring prompt in the world: summarize a website.

The site answers WebFetch with a 415 Unsupported Media Type. Nothing in that response tells Claude what to do next, which is the part Rehberger wants you to notice. Claude decides on its own: "WebFetch got a 415. Let me try directly." It reaches for curl. His generalization of the technique is the sharpest line in the post, and it applies well beyond this one chain. "An attack does not tell the model what to do. The attack just makes the malicious path the one worth pursuing to solve an objective."

The curl request gets a 303 redirect to a ZIP archive. Inside are seven encoded JSON records, a manifest, a macOS decoder binary named decoder-darwin, and a file called struct.py.

Claude refuses to run the binary. That refusal is the exploit. Rehberger: "Claude does not trust the supplied binary decoder, but it trusts the one it wrote itself. The supplied binary acts as a decoy, and deciding not to run it pushes the model towards the danger zone." Claude writes its own small Python decoder and runs it with cd into the extracted directory first, which puts the attacker's folder on Python's module search path. The standard library's base64 module imports struct. Python finds the attacker's struct.py before the real one, and the malicious module re-exports the genuine low-level _struct API so the decode still succeeds and nothing looks wrong.

An obfuscated expression at module level runs during that import. It spawns a detached Python child with python3 -I (isolated mode, so the child does not fall for the same shadowing trick), which pulls a remote stage and opens a callback to a lab command-and-control server. In a second variant the poisoned module launches a headless claude -p instead, so the payload spawns another agent with its own tool access rather than a plain process.

Auto mode's classifier saw a short Python script that decodes a catalogue. That was true. Everything else was several hops downstream of what it was shown.

The number that is accurate and useless

On August 7 Anthropic published the post making auto mode the default for Pro, Max, and Team plans starting August 14, and it carries a commissioned evaluation from Trajectory Labs: 72 indirect prompt injection scenarios, ten runs each, attacks optimized against a model not in the reported set. The result reads "none of the 720 attack attempts succeeded against Claude Fable 5, Opus 5, or Sonnet 5 running auto mode."

That number is real, and it does not contradict Rehberger. He says so himself, plainly, which is why the post is worth your time rather than your outrage: "The benchmark measured a fixed set of 72 scenarios, run 10 times each. My chain was not in that set. So 0.00% on the benchmark and a working RCE are both true at once."

The scope mismatch is bigger than "different scenarios." Anthropic's own methodology note says both harnesses were evaluated through an identical browser integration built by Trajectory Labs, a thin wrapper over Chrome APIs, and that "these results should be viewed as a measurement of the underlying model, rather than the complete set of safeguards which might exist in a given deployment." Rehberger's chain never touches that surface. It runs WebFetch, then Bash, then the local filesystem, then python3. Trajectory Labs publishes its own caveat on its site, and it is the most useful sentence either company wrote: "a low automated attack success rate isn't much evidence that a model is safe."

Two honest deflations while we are here. His success rates are 3/5, 3/5, and 4/5 across three variants, fifteen runs total, with payloads iterated between attempts using Codex. His words: "These are small samples, not a universal ASR measurement." And Simon Willison, who amplified the post, issued a correction on August 30 agreeing with readers that this is arguably not indirect prompt injection at all, because no instruction from the website is ever followed. It is closer to a poisoned environment. If that reading holds, an indirect-prompt-injection benchmark was never the thing this falsifies.

None of which touches the cleanup denial. That failure is independent of what you call the attack.

The documentation is where this gets uncomfortable

Rehberger's framing is that auto mode "is not a security boundary, and hence risky." I went looking for that position in Anthropic's docs, expecting to find it, and it is not there.

The permission modes page carries exactly one warning about auto mode: "Auto mode reduces permission prompts but does not guarantee safety. Use it for tasks where you trust the general direction, not as a replacement for review on sensitive operations." The phrase "security boundary" does not appear. The single mention of prompt injection on that page is attached to bypassPermissions, not auto mode.

Then look at the "Common setups" table on the same page. The auto mode row's isolation column reads: "None; a sandbox or container adds defense in depth."

None. For the mode that has been the default since August 14.

Anthropic's stronger admission lives in the August 7 blog post, and it deserves quoting because it is genuinely candid: auto mode "relies on classification systems and therefore does not eliminate risk." The security page does recommend virtual machines when interacting with external web services. Those are two different documents from the page a user reads when choosing a mode.

Rehberger's complaint is not that Anthropic is wrong about classifiers. He agrees with them: "a classifier is not a sandbox." His complaint is that users get mixed messages, and on the evidence he is right.

Put this into practice this week

The remediation is not a mindset. It is four settings, and the first one takes about ten minutes.

Turn on the sandboxed Bash tool. This is the piece that actually addresses this chain. Per Anthropic's own docs, it uses Seatbelt on macOS and bubblewrap on Linux, and "the operating system enforces the sandbox boundary on the running process, so it holds regardless of what the model chose to run." A detached python3 child inherits the restriction. The classifier's opinion stops mattering.

Set allowUnsandboxedCommands to false. By default, when a command hits the sandbox wall, Claude may retry it with dangerouslyDisableSandbox. Leaving that on gives the model a documented way out of the only boundary you installed.

Write the domain allowlist by hand, and keep it short. Network filtering runs through a userspace proxy, not the kernel, and the docs are direct about the weakness: broad entries like github.com "can create paths for data exfiltration," and code inside the sandbox can attempt domain fronting. Sandboxed Bash commands also inherit the parent environment by default, credentials included, so start your agent from a shell that does not have your cloud keys in it.

Add a PreToolUse hook returning "ask" for the small set of commands you never want approved silently. In auto mode that forces a prompt: the classifier can still deny, but it cannot approve on its own. Interpreter invocations run from a directory the agent just downloaded are a reasonable first entry.

If you only do one of these, do the sandbox. Everything else is refinement.

What this does not prove

Anthropic's published data on auto mode is better than the critique implies, and pretending otherwise would be dishonest. Across 1,053 paid testers, human review caught 13.6% of dangerous commands against auto mode's 89%. Auto mode blocked 800 commands a human approved, while humans blocked six that auto mode allowed. Human catch rates decayed from roughly 17% early in a session to about 5% after fifty prompts, and the classifier's rate stayed flat. Auto mode is a large improvement over the thing it replaced, which was a tired person clicking yes.

The account of Anthropic's response is one-sided, and I want to be precise about it. Rehberger reports the ticket was closed as "Informative" and working as designed. The line everyone is quoting, that auto mode is "a convenience feature backed by a best-effort classifier, not a security guarantee," is his paraphrase, and he flags it as such by hedging on whether he is characterizing Anthropic or one security team. Anthropic declined to comment to The Register. As of today there is no Anthropic statement, advisory, or changelog entry responding to any of this. Treat every sentence attributed to them as reported by an interested party.

The attack is also not independently reproducible. The domain is redacted and IP-allowlisted, and the payload source is not published.

The question worth carrying

Whether this chain counts as prompt injection is an argument for a taxonomy committee. The part that survives every version of that argument is the denial.

Go find the controls in your own stack that only run in one direction. The alert that fires on the deploy but not the rollback. The approval gate on the migration with nothing on the revert. The classifier scoring individual commands with no idea which ones are cleaning up after the others. In this chain the safety mechanism approved the ignition and blocked the fire extinguisher, and it did that while behaving exactly as designed.

You cannot fix that by making the classifier better. You fix it by putting a wall somewhere the classifier does not have a vote.

Sources: Embrace The Red, "Breaking Claude Code Opus 5 Auto Mode"; Anthropic, "Auto mode is now the default in Claude Code"; Claude Code permission modes; Claude Code sandboxing; Claude Code security; Simon Willison's correction; Trajectory Labs.