Anthropic has made auto mode the default setting for Claude Code, relying on it to prevent prompt injection attacks. Johann Rehberger, a prominent researcher in this field, demonstrated a vulnerability where the agent downloads and extracts a zip archive containing a malicious struct.py file. The system imports the base64 module without detecting this local file, allowing harmful code to execute. In specific instances, the safety mechanism directly prevented the agent from stopping the malware. When Claude identified the compromise, Auto Mode blocked the cleanup command intended to terminate the malicious process.
This failure shows that relying solely on internal classifiers is insufficient for securing coding agents against adversarial inputs. The safety layer itself became part of the failure by denying the termination request after the threat was detected. Secure deployment requires external constraints rather than trusting the model to police its own behaviour.
* Run unattended coding agents in a container, VM or OS sandbox
* Restrict network egress
* Do not expose home directories, SSH keys or cloud credentials to the agent runtime
