Anthropic recently made Claude Code's auto mode the default to protect users against prompt injection attacks, but researcher Johann Rehberger has demonstrated a significant vulnerability in this safety mechanism. He identified an attack that succeeds approximately 80% of the time by tricking the agent into downloading and uncompressing a zip archive containing a malicious Python file.
- The exploit relies on executing code that imports `base64`, which inadvertently triggers the execution of a local `struct.py` file extracted from the archive.
- In several instances, Claude Code detected the compromise but was prevented by Auto Mode from terminating the malware process or performing cleanup commands.
- The safety classifier allowed the creation of the malicious process but then blocked the agent's attempt to stop it, effectively becoming part of the failure.
Rehberger concludes that the only safe way to run unattended coding agents is within a sandbox environment, such as a container or VM, while restricting network egress and hiding sensitive credentials.