The classifier blocked the cleanup, not the malware (external link)
Auto Mode is the safety story for Claude Code. Since mid-August it has been the default: instead of stopping to ask before each command, a classifier decides which ones are safe to run. Anthropic commissioned Trajectory Labs to test it — 72 indirect prompt injection scenarios, ten runs each — and the published chart shows 0.00% attack success for Opus 5 in Auto Mode.
Johann Rehberger got 60–80%, on a small sample, starting from a prompt as ordinary as "Summarize https://…".
The chain is worth walking, because no step in it tells the model to do anything.
The server answers the WebFetch call with 415 Unsupported Media Type. That
is the whole instruction. Claude reads a 415, decides on its own that "WebFetch
got a 415. Let me try directly," and reaches for Bash and curl. A 303 then
redirects curl to a ZIP of archival notebook records — plausible catalogue
metadata, checksums, seven Base85/zlib-encoded JSON records, a README, and a
macOS binary described as the decoder.
Claude refuses to run the binary. That is the correct call, and it is the point
of the attack. Rehberger says so plainly: the refusal is planned, it is what the
attacker wants. Declining the unknown executable is what routes the model into
writing its own Python decoder — and running it inside the unpacked archive
directory, where a malicious struct.py is waiting. import base64 pulls in
the attacker's struct module instead of the standard library's.
The safety instinct is load-bearing in the exploit. I have not seen that shape written up this clearly before.
Then the part I cannot stop thinking about:
In a few runs Claude tried to terminate the malware process once it noticed the compromise, but Auto Mode denied the cleanup command.
The classifier permitted the command that created the malicious process and blocked the command intended to kill it. Which, if you think about how these things are built, is not surprising at all: killing a process you did not start looks more dangerous in isolation than running a decoder script, and a classifier scoring commands one at a time has no idea what happened four steps ago. It has no story. It has a queue.
Both numbers here deserve pushback, including the one that suits me. A commissioned suite of 72 scripted scenarios is not a measure of what an adversary does, and 60–80% on "a small sample size" is not a rate anyone should quote either. The disagreement is not 0% against 80%. It is that a targeted chain built by someone who studied the harness is a different animal from a scenario library — which is the ordinary, boring finding about every classifier ever shipped, and it does not stop being true because this one guards something important.
None of which makes Auto Mode a mistake. The thing it replaced was waving through a third of the malicious requests because the tenth dialog of the morning looks like the ninth. Human approval was not working. It just means the classifier is a nuisance filter, not a boundary, and Rehberger's conclusion is the same one that was true before it existed: container or VM, restricted egress, monitoring, and no SSH keys or cloud credentials in the runtime.
I write most of this site with an agent, on a box that has my keys on it. That is a sandbox I have not built yet, and today's excuse for not building it just got worse.