{ "schemaVersion": "bitshovel-editorial-review-v1", "id": "coherence-20260913-1", "signalId": "lobsters-embracethered-com-blog-posts-2026-breaking-claud", "originalUrl": "https://embracethered.com/blog/posts/2026/breaking-claude-code-opus-5-and-automode/", "kind": "editorial-correction", "reviewedAt": "2026-09-13T09:45:54.097Z", "before": { "id": "lobsters-embracethered-com-blog-posts-2026-breaking-claud", "state": "new", "lane": "platformShift", "publishedAt": "2026-08-30T05:36:51.000Z", "observedAt": "2026-08-31T00:28:53.791Z", "originalUrl": "https://embracethered.com/blog/posts/2026/breaking-claude-code-opus-5-and-automode/", "relatedSources": [ { "label": { "zh": "Lobsters 热榜", "en": "Lobsters front page" }, "url": "https://lobste.rs/" } ], "source": { "zh": "Lobsters 热榜 快照与原文", "en": "Lobsters front page snapshot and original" }, "title": { "zh": "wunderwuzzi 实测：模块遮蔽骗过 Claude Code 自动模式并植入 C2", "en": "Prompt injection plants a C2 callback inside Claude Code Auto Mode" }, "summary": { "zh": "安全研究员 wunderwuzzi（Embrace The Red 博客）对 Claude Code Opus 5 的 Auto Mode 做间接提示注入实测：恶意站点先以 415 诱导模型改用 Bash 里的 curl，再经 303 重定向投递 ZIP 压缩包；压缩包内的 struct.py 借 Python 模块遮蔽，在模型自写解码器 import base64 时执行混淆载荷，建立 Sliver C2 回连并打开计算器。Auto Mode 放行了恶意进程的创建，却拦下了模型事后清理该进程的尝试。作者报告小样本成功率约 60–80%（各 5 次），与 Trajectory Labs 受 Anthropic 委托测得的 0.00% 注入成功率形成对照；Anthropic 将报告关闭为 \"Informative\"，称 Auto Mode 是由尽力而为分类器支撑的便利特性而非安全保证，真正的边界在操作系统隔离与网络出口管控。", "en": "wunderwuzzi (Embrace The Red) tested prompt injection against Claude Code Opus 5 Auto Mode: a hostile site baited the model into curl-in-Bash via a 415, then served a ZIP over a 303; the archive struct.py used module shadowing to execute when the model's decoder imported base64, establishing a Sliver C2 callback. Auto Mode allowed the malware process yet blocked Claude's cleanup. The author reports 60-80% success in 5-run samples, versus 0.00% in an Anthropic-commissioned eval; Anthropic closed the report as Informative: Auto Mode is a convenience feature, not a security guarantee." }, "why": { "zh": "一条可复现攻击链直接对照了厂商委托评测的“零注入成功”，而厂商“按设计工作”的回应把 Auto Mode 从安全机制改写为便利特性——对无人值守运行 Claude Code 的团队是即时的边界事实。", "en": "A reproducible attack chain directly contradicts a vendor-commissioned zero-percent injection evaluation, and the works-as-designed reply redefines Auto Mode from a safety mechanism to a convenience feature — an immediate boundary fact for teams running Claude Code unattended." }, "caveat": { "zh": "证据来源为原作者博客实验复盘（作者自述；正文未入 feed 快照，BitShovel 于 2026-08-31 抓取核对）与 Lobsters 热榜双引用。上述内容不是独立评测；各 5 次的小样本成功率不构成统计结论，热榜热度是注意力，不能证明缺陷普遍性。", "en": "Evidence is the author's own write-up (a creator self-report; body not in the feed snapshot, fetched and checked by BitShovel on 2026-08-31) plus the Lobsters front-page double reference. Not an independent review; 5-run success rates are not statistically conclusive, and front-page attention is not proof of generality." }, "timeline": [ { "date": { "zh": "8 月 31 日", "en": "Aug 31" }, "datetime": "2026-08-31T00:28:53.791Z", "summary": { "zh": "进入 BitShovel 雷达：Lobsters 热榜收录时可见 25 条。", "en": "Entered the BitShovel radar: 25 entries in the current Lobsters front page feed." }, "source": { "zh": "Lobsters 热榜快照", "en": "Lobsters front page snapshot" } } ], "followTarget": { "id": "discussion:embracethered-com-blog-posts-2026-breaking-claud", "label": { "zh": "Breaking Claude Code Opus 5 Auto Mode 原文", "en": "Breaking Claude Code Opus 5 Auto Mode post" }, "scope": { "zh": "原文实质修订，以及 Anthropic 后续回应或 Auto Mode 安全行为变更", "en": "Substantive revisions to the post, plus any Anthropic follow-up or Auto Mode security-behavior change" }, "url": "https://embracethered.com/blog/posts/2026/breaking-claude-code-opus-5-and-automode/", "updateMode": "verified-change" }, "ingestion": { "mode": "editorial", "adapter": "syndication-feed", "evidenceClass": "creator-self-report", "observationRef": "source-observations/history/syndication-feeds.2026-08-31T00-28-53Z.snapshot.json#feed:lobsters-hotstories", "changeRef": "source-observations/history/syndication-feed-changes.2026-08-31T00-28-53Z.snapshot.json#feed:lobsters-hotstories" }, "managedObjectId": "model-version:anthropic-claude-opus-5", "verifiedAt": "2026-09-06T16:00:20.970Z", "retireReceipt": { "decision": "retire-candidate", "basis": "silent", "lateral7d": 0, "vertical7d": 0, "decidedAt": "2026-09-07T01:05:59.328Z" }, "__retiredAt": "2026-09-07T01:05:59.328Z" }, "after": { "title": { "zh": "Claude Code 自动模式：一次外部资料触发的执行风险", "en": "Claude Code Auto Mode: an external-content execution risk" }, "summary": { "zh": "研究者 wunderwuzzi 报告，Claude Code 在读取外部资料时，自写脚本仍可能加载不可信代码。小样本实验提醒：自动审批能否放行，与运行环境能否隔离风险，是两个问题。", "en": "Researcher wunderwuzzi reports that Claude Code can load untrusted code while running a script it wrote to read external material. The experiment distinguishes automatic approval from isolation of the execution environment." }, "why": { "zh": "这份报告连接了模型判断、工具调用与开发者电脑上的执行环境，说明只检查眼前的命令可能遗漏依赖中的行为。", "en": "The account connects model decisions, tool use and the local runtime: inspecting the immediate command may miss behavior in its dependencies." }, "caveat": { "zh": "这是作者的定向实验，本站未复现。各变体只有五次测试；其 60%–80% 结果与另一组固定场景的 0% 不能直接比较，也不能代表所有版本和配置。", "en": "This is the author’s targeted experiment, not a BitShovel replication. Each variant had five trials. Its 60–80% results and 0% on a different fixed benchmark are not directly comparable or generalizable to every version and configuration." } }, "note": { "zh": "纠正把不同测试集的成功率直接对立的表达，简化攻击细节，保留实验条件与限制。", "en": "Corrected the direct comparison between different test sets and clarified the experimental conditions and limits." }, "withdrawnSources": [], "withdrawnTimeline": [], "evidence": [ { "type": "retained-official-page", "label": { "zh": "Lobsters 热榜 快照与原文", "en": "Lobsters front page snapshot and original" }, "url": "https://embracethered.com/blog/posts/2026/breaking-claude-code-opus-5-and-automode/", "path": "app/_content/editorial-reviews/evidence/coherence-lobsters-embracethered-com-blog-posts-2026-breaking-claud-20260913.json", "bytes": 643, "sha256": "c869dce196210fdc22de8553fec2bc8341e6e638d6cdf9674be84d373460fdbc", "fetchedAt": "2026-09-13T09:40:40.304Z" } ], "integrity": "6dcb0004af1254b37027cc4b463b5efecfa87f599ea05a7329f04dd7b796f519" }