Breaking Claude Code Opus 5 Auto Mode

A researcher demonstrated that Claude Code's Auto Mode can be hijacked with 60-80% success rate through a targeted prompt injection attack involving a malicious website, contradicting Anthropic's commissioned evaluation showing 0.00% attack success. The attack redirects Claude from using the WebFetch tool to curl, then chains together encoding tricks and Python module shadowing to achieve code execution. The findings suggest that Auto Mode's safety classifier is not an adequate substitute for isolated environment execution and active monitoring of AI agent behavior.