Agentic data science with the Data Agent Kit
cloud.google.com·6h ago
Data Science
Simon Willison's Blog·Aug 27·5 min read
Breaking Claude Code Opus 5 Auto Mode
TL;DR
Claude Code's auto mode, designed to protect against prompt injection attacks, has been found vulnerable by researcher Johann Rehberger, who demonstrated an 80% success rate in exploiting it. This raises concerns about the effectiveness of the auto mode in safeguarding users.
✦ Why It Matters
Evaluate your use of Claude Code's auto mode and consider additional security measures against prompt injection.
Key Takeaways
- Review the security of your coding agents using Claude Code.
- Stay informed about vulnerabilities in AI coding tools.
- Implement additional safeguards against prompt injection attacks.
- Test your systems against known exploitation methods.
Full Summary
Claude Code's auto mode, developed by Anthropic, aims to defend coding agents from prompt injection attacks, which manipulate the input to execute harmful commands. Johann Rehberger, a prominent researcher in this field, discovered a vulnerability that allows an attacker to trick Claude Code into downloading and executing malicious code from a zip archive.
His method reportedly succeeds 80% of the time, highlighting significant flaws in the auto mode's protective measures. In some instances, the auto mode failed to prevent harmful code execution and even denied cleanup commands when the agent attempted to terminate the malware process.
These findings suggest that while auto mode is a step towards security, it is not foolproof and requires further refinement to effectively protect users from sophisticated attacks.