According to verification results posted on Hacker News, a vulnerability allowing code execution via indirect prompt injection has been identified in Claude Code's Auto Mode.
Auto Mode has been the default setting for Claude Code since mid-August. In this mode, a system is implemented where safety is determined by a safety classifier without requiring human approval.
Anthropic announced that in an evaluation conducted by external vendor Trajectory Labs, the attack success rate for Opus 5 across 72 scenarios was 0.00%. However, this latest verification recorded success rates between 60% and 80%—albeit with a small sample size—by utilizing a specific attack chain.
In the specific attack process, the user first requests a summary of a website. The target server is configured to deny access via the WebFetch tool, which induces Claude to autonomously use the Bash tool and curl to download a ZIP archive.
The ZIP contains data encoded in a specific format. While Claude avoids executing binary files, it was shown that the model is guided toward the attacker's intended operations through the data decoding process.
The verifier stated that when considering the risks of model misalignment and prompt injection, Auto Mode alone is not sufficient, and it is essential to run agents in isolated environments and monitor their behavior.
Source: Breaking Claude Code Opus 5 Auto Mode (Hacker News Frontpage, 2026-08-31)