Hacker News front pageAug 31, 2026, 15:49 UTC+8

Claude Code Opus 5 Auto Mode broken via indirect prompt injection, up to 80% success

Breaking Claude Code Opus 5 Auto Mode

A security researcher got Claude Code Opus 5 in Auto Mode to execute malicious code via a simple 'summarize this page' prompt. The chain: an HTTP 415 nudges the model from WebFetch to curl, which downloads a ZIP; the model refuses to run the included binary and writes its own Python decoder, but runs it inside the attacker-controlled directory; a planted struct.py shadows the standard library import, achieving code execution. The author measured 60–80% success on a small sample, while a third-party eval commissioned by Anthropic had reported 0.00% attack success for Opus 5 in Auto Mode. The post does not disclose whether a fix has shipped.

Why it matters: A security researcher demonstrated a practical bypass of Claude Code Opus 5's Auto Mode, using HTTP 415 to trick the model into executing malicious curl commands with 60-80% success, directly challenging Anthropic's commissioned 0% injection rate finding. The technical detail ...

Read the original ↗Export Markdown

Take

This post lands because it directly contradicts a third-party eval Anthropic commissioned from Trajectory Labs, which reported 0.00% attack success for Opus 5 Auto Mode across 72 indirect prompt injection scenarios. wunderwuzzi didn't replicate those 72 scenarios—he built his own chain. The trick: an HTTP 415 nudges the model to abandon WebFetch for curl, which downloads a ZIP. The model refuses to run the included binary decoder and writes its own Python decoder instead, but executes it inside the attacker-controlled directory. A planted struct.py shadows the standard library import, and code execution follows. The chain never tells the model what to do; it just makes the malicious path the obvious next step. He measured 60–80% success on a small sample—the post doesn't say how many runs. The test site was allow-listed, so this isn't a wild success rate. The bigger point: Auto Mode's safety classifier is not a substitute for running agents in an isolated environment, especially when the model writes and executes code in untrusted directories. No word yet on whether Anthropic has shipped a fix.

Source: Hacker News front page · embracethered.com
Published: Aug 31, 2026, 15:49 UTC+8 · Aug 31, 2026