CARD · Card record

Prompt injection plants a C2 callback inside Claude Code Auto Mode

wunderwuzzi (Embrace The Red) tested prompt injection against Claude Code Opus 5 Auto Mode: a hostile site baited the model into curl-in-Bash via a 415, then served a ZIP over a 303; the archive struct.py used module shadowing to execute when the model's decoder imported base64, establishing a Sliver C2 callback. Auto Mode allowed the malware process yet blocked Claude's cleanup. The author reports 60-80% success in 5-run samples, versus 0.00% in an Anthropic-commissioned eval; Anthropic closed the report as Informative: Auto Mode is a convenience feature, not a security guarantee.

01
THE STORY · The original

Read the explanation and its limits.

  • Originalcreator self-reporthttps://embracethered.com/blog/posts/2026/breaking-claude-code-opus-5-and-automode/

Why it is worth understanding

A reproducible attack chain directly contradicts a vendor-commissioned zero-percent injection evaluation, and the works-as-designed reply redefines Auto Mode from a safety mechanism to a convenience feature — an immediate boundary fact for teams running Claude Code unattended.

Conditions and limitations

Evidence is the author's own write-up (a creator self-report; body not in the feed snapshot, fetched and checked by BitShovel on 2026-08-31) plus the Lobsters front-page double reference. Not an independent review; 5-run success rates are not statistically conclusive, and front-page attention is not proof of generality.

Reading progress is saved in this browser. Save or add a note →

02
THE THREAD · Full timeline

1 event, every row traceable.

A card accumulates records as its story develops: new corroborators, market contrasts, material changes at the original — each dated and linked to its archive day.

Card timeline
  1. Added to BitShovelEntered the BitShovel radar: 25 entries in the current Lobsters front page feed.

03
SOURCES · Sources and evidence

Check each link's purpose and limits.

Sources and evidence · 2 links

Each link has a purpose and scope. Link counts do not establish independent confirmation; direct support applies only to the statements specified below.

Found an error or a problem? Send feedback ↗