Security Researcher Defeats Claude Code Auto Mode

Security researcher Johann Rehberger has successfully bypassed the auto mode safety feature in Anthropic's Claude Code, exposing a critical vulnerability in how the coding agent handles untrusted files. Anthropic recently made auto mode the default setting for Claude Code, promoting it as a robust defense against prompt injection attacks. However, Rehberger's exploit bypassed these defenses with an 80% success rate, raising serious questions about the tool's built-in security posture and Anthropic's bold claims regarding its effectiveness.

The attack vector tricks Claude Code into downloading and uncompressing a malicious zip archive. Once extracted, the agent is manipulated into executing code that imports the standard base64 library. Unbeknownst to the agent, this action triggers the import and execution of a local, malicious struct.py file that was hidden inside the zip archive.

In a bizarre twist, the safety classifier itself became an obstacle to remediation. When Claude Code eventually detected the compromise and attempted to terminate the active malware process, the auto mode safety mechanism intervened. Instead of stopping the threat, the classifier blocked the agent's own cleanup command, allowing the malicious process to continue running.

For software developers and system administrators, this vulnerability underscores the danger of running autonomous AI agents directly on local machines. Security experts warn that practitioners must never run unattended coding agents without strict isolation. To protect sensitive environments, agents should only be executed within secure containers, virtual machines, or operating system sandboxes. Furthermore, developers must ensure that home directories, SSH keys, and cloud credentials remain completely inaccessible to the agent's runtime environment, as relying solely on built-in LLM guardrails is no longer a viable strategy.