Breaking Claude Code Opus 5 Auto Mode
Points and comments are a snapshot, not live.
Python module shadowing trick achieves 60-80% code execution in Claude Code Auto Mode.
The author demonstrates a prompt injection attack chain against Claude Code Opus 5 in Auto Mode, achieving up to 80% success. The attack tricks Claude into using `curl` instead of `WebFetch`, downloads a ZIP archive containing malicious `struct.py`, and exploits Python module shadowing when Claude writes and runs its own decoder. The malicious code spawns a child process that downloads a remote payload and establishes C2 callbacks. Anthropic responded that Auto Mode is a convenience feature, not a security guarantee, and that the attack is working as designed. The author contrasts this with Anthropic's public claims of 0.00% attack success on their benchmarks.
What commenters are saying
Several commenters argue this is not truly prompt injection but a Python trojan aimed at Claude's specific behavioral patterns. Some note that Auto Mode gives false confidence, while others point out the same attack could work with human users. A few highlight the irony that Auto Mode blocked Claude's attempted cleanup after compromise. One commenter rants about PEP-668 and Python's module shadowing issue. Another notes the attack relies on learning Claude's tics: it reliably uses `python -c` and runs from the extracted directory.