Breaking Claude Code Opus 5 Auto Mode

380 points · 116 comments on HN · read original →

Points and comments are a snapshot, not live.

Python module shadowing trick achieves 60-80% code execution in Claude Code Auto Mode.

The author demonstrates a prompt injection attack chain against Claude Code Opus 5 in Auto Mode, achieving up to 80% success. The attack tricks Claude into using `curl` instead of `WebFetch`, downloads a ZIP archive containing malicious `struct.py`, and exploits Python module shadowing when Claude writes and runs its own decoder. The malicious code spawns a child process that downloads a remote payload and establishes C2 callbacks. Anthropic responded that Auto Mode is a convenience feature, not a security guarantee, and that the attack is working as designed. The author contrasts this with Anthropic's public claims of 0.00% attack success on their benchmarks.

What commenters are saying

Several commenters argue this is not truly prompt injection but a Python trojan aimed at Claude's specific behavioral patterns. Some note that Auto Mode gives false confidence, while others point out the same attack could work with human users. A few highlight the irony that Auto Mode blocked Claude's attempted cleanup after compromise. One commenter rants about PEP-668 and Python's module shadowing issue. Another notes the attack relies on learning Claude's tics: it reliably uses `python -c` and runs from the extracted directory.