Researcher bypasses Claude Code Opus 5 auto mode in 80% of prompt injection tests

The reported vulnerability exposes a fundamental limitation in Anthropic's auto mode safety mechanism. While designed to prevent prompt injection attacks, the system appears to have a critical failure mode where it blocks the agent's own remediation attempts. This creates a scenario where the safety mechanism itself becomes part of the attack chain rather than a defense against it.

The attack vector demonstrates how AI coding agents can be manipulated through seemingly benign operations. By convincing the agent to process a zip archive, the attacker bypasses direct code execution restrictions. The base64 import trick shows how attackers can exploit legitimate programming patterns to deliver malicious payloads, making detection more difficult for both the AI and human reviewers.

The 80% success rate reported in testing suggests this is not an edge case but a systematic vulnerability. While Anthropic made auto mode the default protection, the research indicates it provides insufficient isolation for production use. The failure to prevent cleanup commands after compromise detection is particularly concerning as it shows the system actively working against its own security objectives.

The recommended mitigation strategy highlights the current state of AI security: there is no substitute for traditional isolation techniques. Sandboxing, network restrictions, and credential isolation remain necessary despite vendor claims about built-in safety mechanisms. This creates additional operational overhead for teams deploying AI coding assistants, as they must implement these protections themselves rather than relying on the AI's internal safeguards.