news-tldr.com

The important facts, the open questions, and the sources — without the churn.

← Latest briefing

Technology

Researcher demonstrates indirect prompt injection exploit in Claude Code Auto Mode

A security researcher achieved remote code execution on Claude Code Opus 5 in Auto Mode, challenging earlier evaluations that reported a zero percent attack success rate.

Updated Aug 31, 2026 · 10:20 UTC1 reports

The short version

  • A security researcher demonstrated an indirect prompt injection attack chain against Anthropic's Claude Code Opus 5 running in default Auto Mode, achieving code execution success rates between 60% and 80% across small test samples.
  • The attack exploited Python module shadowing after the model declined to run a suspicious binary, prompting it to write its own script in a directory containing a poisoned module.
  • Anthropic marked the security report as Informative, stating Auto Mode relies on a best-effort classifier rather than serving as a security sandbox.

Key facts

  • A security researcher demonstrated an indirect prompt injection attack against Claude Code Opus 5 in Auto Mode that achieved code execution in 60% to 80% of test runs.[Hacker News]
  • The exploit chain used Python module shadowing inside an unzipped directory to trick a model-generated decoder script into downloading and running a remote payload.[Hacker News]
  • During some test runs, Auto Mode's safety classifier prevented Claude from executing commands to terminate the malware process after the compromise was recognized.[Hacker News]
  • An Anthropic-commissioned evaluation by Trajectory Labs previously reported a 0.00% prompt injection attack success rate for Opus 5 across 72 tested scenarios.[Hacker News]
  • Anthropic designated the researcher's report as Informative, clarifying that Auto Mode is a convenience feature using a safety classifier and that OS isolation and network egress controls are required for security.[Hacker News]

What remains uncertain

  • The attack success rates were derived from small sample sizes in a controlled testing environment and may vary under broader deployment conditions.[Hacker News]

Sources