CARD · Card record
Prompt injection plants a C2 callback inside Claude Code Auto Mode
wunderwuzzi (Embrace The Red) tested prompt injection against Claude Code Opus 5 Auto Mode: a hostile site baited the model into curl-in-Bash via a 415, then served a ZIP over a 303; the archive struct.py used module shadowing to execute when the model's decoder imported base64, establishing a Sliver C2 callback. Auto Mode allowed the malware process yet blocked Claude's cleanup. The author reports 60-80% success in 5-run samples, versus 0.00% in an Anthropic-commissioned eval; Anthropic closed the report as Informative: Auto Mode is a convenience feature, not a security guarantee.
01
THE STORY · The original
Read the explanation and its limits.
- Originalcreator self-reporthttps://embracethered.com/blog/posts/2026/breaking-claude-code-opus-5-and-automode/
Why it is worth understanding
A reproducible attack chain directly contradicts a vendor-commissioned zero-percent injection evaluation, and the works-as-designed reply redefines Auto Mode from a safety mechanism to a convenience feature — an immediate boundary fact for teams running Claude Code unattended.
Conditions and limitations
Evidence is the author's own write-up (a creator self-report; body not in the feed snapshot, fetched and checked by BitShovel on 2026-08-31) plus the Lobsters front-page double reference. Not an independent review; 5-run success rates are not statistically conclusive, and front-page attention is not proof of generality.
Reading progress is saved in this browser. Save or add a note →
02
THE THREAD · Full timeline
1 event, every row traceable.
A card accumulates records as its story develops: new corroborators, market contrasts, material changes at the original — each dated and linked to its archive day.
- Added to BitShovelEntered the BitShovel radar: 25 entries in the current Lobsters front page feed.
03
SOURCES · Sources and evidence
Check each link's purpose and limits.
Sources and evidence · 2 links
Each link has a purpose and scope. Link counts do not establish independent confirmation; direct support applies only to the statements specified below.
- Lobsters front page snapshot and originalScope not documented
A per-link statement of support has not been attached.
- Lobsters front pageScope not documented
A per-link statement of support has not been attached.