Breaking Claude Code Opus 5 Auto Mode
- Source
- simonwillison.net
- Date
Context
A command-approval classifier can miss danger hidden in the environment where a command runs. In Johann Rehberger's reported test of Auto Mode, Anthropic's Claude Code refused to run a supplied executable but wrote its own decoder and ran it inside the untrusted extracted directory. A local file impersonating a standard Python module then executed during an import.
The reported 80% success figure came from four successes in five trials of one variant, not a general failure rate. Simon Willison's later update describes this as a confused-environment attack rather than classic . The case illustrates why approving an apparently ordinary command and restricting what its process can access are separate protections.
- prompt injection — An attack that hides instructions in content an AI will read — a webpage, email, or document — tricking it into following the attacker instead of the user.
- AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
Checking sign-in…
Loading comments…