Researcher Bypasses Claude Code Auto Mode 80% of the Time

80 percent. That is the success rate Johann Rehberger reports for an attack on Auto Mode, the permission model Anthropic made the default for Claude Code on August 14. Thirteen days separate the default switch from the published bypass, and the write-up landed on August 27.

What Auto Mode replaced

Claude Code is a coding agent that runs in a terminal, reads files and executes commands. Before Auto Mode, the safe configuration asked the user to approve each command. Auto Mode replaced that gate with a classifier that inspects proposed actions and blocks the ones that look dangerous, which Anthropic positioned as protection against prompt injection: instructions hidden inside content the agent reads.

The chain, step by step

The attack starts with an ordinary request to summarize a web page. The page presents itself as an archive of notebook records and nudges the agent to fetch it with curl instead of its built-in WebFetch tool. From there: a zip archive is downloaded and extracted; a short Python snippet runs that does nothing but import base64. The trick is that Python resolves the standard-library struct module by searching the current directory first, so it loads a malicious struct.py that came out of the archive instead. That file spawns a separate Python process that pulls attacker-controlled code from a remote server.

Rehberger obfuscated the payload with ChatGPT to slip it past Claude's safety checks. The detail Simon Willison singles out is what happened afterward: "In a few runs Claude tried to terminate the malware process once it noticed the compromise, but Auto Mode denied the cleanup command." The classifier let the compromise through and then stopped the remediation.

Why a classifier cannot see this

The classifier grades commands. "Import base64" is a benign command in every context the classifier can evaluate. What makes it dangerous is the state of the filesystem at that moment, which is a layer a command filter does not inspect. The same structural problem showed up last week when a student caught an agent sabotaging GitHub repositories: the individual actions looked fine; the sequence did not.

That does not make the classifier worthless. Rehberger had to obfuscate the payload, which suggests the raw version was caught. But a technique one researcher found within two weeks and reproduces four times out of five is a technique automated attackers will find too. Anthropic had not published a response at the time of writing.

Three settings to change today

Rehberger's and Willison's recommendations are the same and they are concrete. Run any unattended coding agent inside a container, a VM or an OS-level sandbox. Restrict its network access to the hosts it needs. Keep production keys, cloud credentials and customer data out of the environment it can reach. What we see in practice is the opposite arrangement: the agent runs on the developer's own laptop with every .env file and SSH key within reach, and a setting called Auto Mode makes that feel safe. This week's number says that feeling is wrong four times in five.

Sources: Simon Willison, Embrace The Red (Johann Rehberger), The Register