Claude Code Opus 5 Auto Mode Prompt Injection Bypass: Detection and Hardening Guide for AI Coding Agents

Johann Rehberger — one of the most credible prompt injection researchers working today — has demonstrated a bypass of Anthropic's Claude Code auto mode, the approval-gating mechanism Anthropic recently made the default protection for its coding agent. According to Rehberger's research, the attack works roughly 80% of the time: malicious content ingested by Claude Code tricks the agent into downloading and uncompressing a zip archive, then executing code that imports base64 — an innocuous-looking standard library import that masks the actual malicious payload — without the agent recognizing the danger and without auto mode flagging the action for user approval.

This matters far beyond Claude Code itself. Anthropic has made bold public claims about auto mode's effectiveness against prompt injection, and enterprise development teams are deploying AI coding agents with broad filesystem, shell, and network access at scale. If the primary guardrail can be defeated four times out of five by content the agent reads — a README, a webpage, a GitHub issue, a fetched dependency doc — then every organization running agentic coding tools needs compensating detective controls today, not after a supply-chain incident forces the issue.

No CVE has been assigned to this behavior; it is a design-level weakness in LLM-based guardrails, not a patchable memory bug. That is precisely why detection engineering and environment hardening are your levers.

Technical Analysis

Affected Products and Platforms

Claude Code (Anthropic's agentic CLI coding tool), Opus 5 model generation, with auto mode enabled — which is now the default configuration as of August 2026
Any host (developer workstation, CI runner, cloud dev container) where Claude Code operates with tool-use permissions: shell execution, file writes, and outbound network access
The weakness is in the model-mediated approval logic, so it transcends OS — Windows, macOS, and Linux hosts are all affected equally

How the Attack Works (Defender's View)

Prompt injection against an agentic tool is an indirect attack chain: the adversary never touches your host directly. The attack chain Rehberger describes breaks down as follows:

Delivery via ingested content: The attacker plants malicious instructions in content Claude Code will read during a legitimate task — repository files, web pages fetched by the agent, issue trackers, package documentation, or even MCP server responses.
Benign-looking staged actions: The injected instructions decompose the attack into steps that individually look harmless to auto mode's classifier: (a) download a zip archive, (b) uncompress it, (c) run a script that imports base64. None of these actions, in isolation, trips the guardrail.
Payload execution: The extracted code executes with the full permissions of the Claude Code process — which typically inherits the developer's credentials, SSH keys, cloud tokens, and network reachability. The base64 import is a tell: obfuscated payload content is decoded at runtime so static review of the script sees nothing alarming.

The core exploitation requirement is only that the agent reads attacker-controlled text during a session — the defining characteristic of indirect prompt injection (MITRE ATLAS AML.T0051). Auto mode's failure is a classification failure across a multi-step chain: the guardrail evaluates actions in isolation and misses cumulative malicious intent.

Exploitation Status

Status: Working proof-of-concept published by a credible researcher; claimed ~80% success rate against auto mode
Active exploitation: No confirmed in-the-wild campaign as of publication, but the technique requires no exploit kit — any attacker who can get text into an agent's context (poisoned repo, SEO'd malicious doc page, compromised dependency README) can attempt it
CISA KEV: Not applicable (no CVE)
Vendor posture: Anthropic positions auto mode as the default mitigation; defenders should treat that claim as partially invalidated and layer their own controls

The 80% success rate is the number to internalize. A guardrail that fails four out of five times is not a control — it is a speed bump. Treat Claude Code as an over-privileged, non-deterministic privileged user and instrument it accordingly.

Detection & Response

The good news: while the model's decision-making is opaque, its host-level behavior is not. The attack chain produces highly observable telemetry — archive downloads, extraction utilities, script interpreters executing code from freshly written temp/extraction directories, and Python doing base64 decode-and-execute patterns. These are detectable with rules that have low false-positive rates in most environments, because legitimate developer workflows rarely chain "download archive → extract → immediately execute script from extraction path" in a single burst.

Sigma Rules

YAML

---
title: Claude Code Agent Archive Download Followed by Extraction
id: 3f8a1c92-7d4e-4b1a-9c6f-2e5d8a0b1f34
status: experimental
description: Detects a download utility (curl/wget/Invoke-WebRequest) retrieving an archive followed by extraction activity, consistent with the Claude Code auto mode prompt injection chain where the agent is tricked into downloading and uncompressing a zip archive.
references:
  - https://simonwillison.net/2026/Aug/27/breaking-claude-code-opus-5-auto-mode/
  - https://embracethered.com/blog/posts/2026/breaking-claude-code-opus-5-and-automode/
  - https://atlas.mitre.org/techniques/AML.T0051
author: Security Arsenal
date: 2026/08/28
tags:
  - attack.execution
  - attack.command_and_control
  - attack.t1105
  - atlas.aml.t0051
logsource:
  category: process_creation
  product: windows
detection:
  selection_download:
    Image|endswith:
      - '\curl.exe'
      - '\wget.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - '.zip'
      - '.tar.gz'
      - '.tgz'
      - 'Invoke-WebRequest'
      - 'iwr '
      - 'Start-BitsTransfer'
  selection_extract:
    Image|endswith:
      - '\Expand-Archive'
      - '\tar.exe'
      - '\unzip.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Expand-Archive'
      - '-xf '
      - 'x -o'
  condition: selection_download or selection_extract
falsepositives:
  - Legitimate developer dependency downloads and build scripts
  - Tune by correlating with ParentImage of node.exe/claude processes where available
level: medium
---
title: Script Interpreter Executing from Freshly Extracted or Temp Path
id: 9b2e5f17-3a8c-4d6e-b1f4-7c0d2e9a5b83
status: experimental
description: Detects Python or script interpreters executing files from temporary, Downloads, or freshly extracted directories — the final execution stage of the Claude Code auto mode bypass where uncompressed payload code is run.
references:
  - https://simonwillison.net/2026/Aug/27/breaking-claude-code-opus-5-auto-mode/
  - https://atlas.mitre.org/techniques/AML.T0051
author: Security Arsenal
date: 2026/08/28
tags:
  - attack.execution
  - attack.t1059.006
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\node.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - '\Temp\'
      - '\Tmp\'
      - '\Downloads\'
      - '\AppData\Local\Temp\'
      - '$env:TEMP'
  filter_venv:
    CommandLine|contains:
      - '\.venv\'
      - 'site-packages'
  condition: selection and not filter_venv
falsepositives:
  - Installer bootstrap scripts
  - Ad-hoc developer testing; correlate with preceding archive extraction events
level: high
---
title: Python Base64 Decode with Dynamic Execution Pattern
id: c41d7a90-5f2b-4e8c-a3d6-1b9e0f4c2a75
status: experimental
description: Detects Python invoked with inline commands combining base64 decoding and exec/eval, the obfuscation hallmark noted in the Claude Code auto mode bypass where a benign-looking base64 import conceals the payload.
references:
  - https://simonwillison.net/2026/Aug/27/breaking-claude-code-opus-5-auto-mode/
  - https://attack.mitre.org/techniques/T1027/
author: Security Arsenal
date: 2026/08/28
tags:
  - attack.defense_evasion
  - attack.t1027
  - attack.t1059.006
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\python.exe'
      - '\python3.exe'
    CommandLine|contains:
      - 'base64'
  selection_exec:
    CommandLine|contains:
      - 'b64decode'
      - 'exec('
      - 'eval('
      - 'decode('
  condition: selection and selection_exec
falsepositives:
  - Rare in standard development; some legitimate encoding utilities
level: high

KQL — Microsoft Sentinel / Defender Hunt

This query hunts the full chain: archive download or extraction activity followed within 10 minutes by script execution from a temp/extraction path on the same device. It works on Defender process telemetry; if you ingest developer Linux/macOS hosts via Syslog, adapt the table to Syslog accordingly.

KQL — Microsoft Sentinel / Defender

// Claude Code auto-mode prompt injection chain: archive fetch/extract -> script execution
let lookback = 3d;
let window = 10m;
let archiveActivity = DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where FileName in~ ("curl.exe", "wget.exe", "tar.exe", "unzip.exe", "7z.exe", "powershell.exe", "pwsh.exe", "curl", "wget", "tar", "unzip", "python", "python3")
    | where ProcessCommandLine has_any (".zip", ".tar.gz", ".tgz", "Expand-Archive", "Invoke-WebRequest", "unzip", "tar -x", "tar xf", "-O ", "-o ")
    | project DeviceId, DeviceName, DownloadTime = Timestamp, DownloadCmd = ProcessCommandLine, DownloadProc = FileName, InitiatingProcess = InitiatingProcessFileName;
let scriptExec = DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where FileName in~ ("python.exe", "python3.exe", "node.exe", "powershell.exe", "pwsh.exe", "bash", "sh", "python", "python3")
    | where ProcessCommandLine has_any ("Temp", "tmp", "Downloads", "base64", "b64decode", "exec(")
    | project DeviceId, ExecTime = Timestamp, ExecCmd = ProcessCommandLine, ExecProc = FileName;
archiveActivity
| join kind=inner scriptExec on DeviceId
| where ExecTime between (DownloadTime .. DownloadTime + window)
| project DeviceName, DownloadTime, DownloadProc, DownloadCmd, ExecTime, ExecProc, ExecCmd
| order by DownloadTime desc;

Velociraptor VQL Hunt

For DFIR teams, this artifact enumerates running script interpreters whose command lines reference temp/download paths or base64 decode patterns — a rapid triage sweep across a developer fleet when you suspect an agent session was hijacked.

VQL — Velociraptor

-- Hunt: script interpreters executing from temp/download paths or with base64 decode patterns
-- Relevant to Claude Code prompt-injection payload execution stage
SELECT Pid,
       Ppid,
       Name,
       CommandLine,
       Exe,
       Username,
       CreateTime
FROM pslist()
WHERE (Name =~ '(?i)python|node|powershell|pwsh|bash|sh$')
  AND (CommandLine =~ '(?i)(temp|tmp|downloads)'
       OR CommandLine =~ '(?i)(base64|b64decode)'
       OR CommandLine =~ '(?i)exec\(|eval\(')

Remediation / Hardening Script

There is no patch to apply — the fix is environmental: constrain what an AI coding agent can do even when its judgment is compromised. This Bash script applies egress and filesystem guardrails for hosts running Claude Code and audits for indicators of the attack chain.

Bash / Shell

#!/usr/bin/env bash
# Harden hosts running Claude Code against prompt-injection-driven payload execution
# Run on developer workstations / CI runners where the agent operates

set -euo pipefail

echo "[1/4] Checking for Claude Code configuration..."
CLAUDE_CFG="$HOME/.claude"
if [ -d "$CLAUDE_CFG" ]; then
  echo "  Found $CLAUDE_CFG — review permissions and disable auto-approval for shell/network tools"
  grep -riE 'autoApprove|allowlist|permissions' "$CLAUDE_CFG" 2>/dev/null || echo "  No explicit permission config found; defaults apply"
fi

echo "[2/4] Auditing recent archive download + extraction artifacts in user temp/download dirs..."
find "$HOME/Downloads" /tmp "$TMPDIR" -maxdepth 2 \( -name '*.zip' -o -name '*.tar.gz' -o -name '*.tgz' \) -mtime -7 2>/dev/null | while read -r f; do
  echo "  Recent archive: $f (mtime: $(stat -c %y "$f" 2>/dev/null || stat -f %Sm "$f"))"
done

echo "[3/4] Checking shell history for suspicious download->extract->execute chains..."
grep -hE '(curl|wget).*(\.zip|\.tar\.gz|\.tgz)' "$HOME/.bash_history" "$HOME/.zsh_history" 2>/dev/null | tail -20 || echo "  None found"

echo "[4/4] Applying egress restriction example (nftables) — restrict agent tool user to approved destinations..."
# Create a dedicated unprivileged user for agent execution if not present
if ! id claudeagent &>/dev/null; then
  sudo useradd -r -s /bin/bash -m claudeagent && echo "  Created restricted user 'claudeagent'"
fi
# Example: block the agent user from arbitrary outbound except approved hosts
sudo nft add table inet agentfilter 2>/dev/null || true
sudo nft add chain inet agentfilter output '{ type filter hook output priority 0; policy accept; }' 2>/dev/null || true
sudo nft add rule inet agentfilter output skuid claudeagent tcp dport 443 ip daddr != 140.82.112.0/20 drop 2>/dev/null || true
echo "  Egress rule applied: agent user outbound 443 restricted to GitHub range (customize to your allowlist)"

echo "DONE. Next: run Claude Code under the restricted user, enforce sandboxing (see Remediation), and enable process/command-line logging (auditd/Sysmon) if not already present."

Remediation

Because this is a model-level guardrail failure rather than a patchable vulnerability, remediation is architectural. Prioritize in this order:

Do not rely on auto mode as your sole control. Anthropic's own default has been demonstrated bypassable at a ~80% success rate. Reconfigure Claude Code to require explicit human approval for: shell command execution, file writes outside the project tree, and any network-fetching tool invocation. Review Anthropic's documentation and changelogs for permission hardening options as they ship updates.
Sandbox the agent's execution environment. Run Claude Code in a container, VM, or restricted OS user with: no access to SSH keys, cloud credentials, or browser credential stores; an egress allowlist limited to required package registries and API endpoints; and a read-only mount of anything it doesn't need to modify.
Strip ambient credentials. The blast radius of a successful injection equals whatever the developer's session can reach. Use short-lived, scoped tokens (OIDC-based cloud auth rather than static keys), and never run the agent with production access.
Untrusted-content handling policy. Treat everything the agent reads — repos, web fetches, MCP server responses, issue trackers — as untrusted input. Disable or gate autonomous web fetching; pin and review MCP servers; be especially wary of the agent pulling content from attacker-influenceable sources mid-task.
Deploy the detections above. Archive-download → extraction → interpreter-execution chains and Python base64 decode-and-exec patterns are high-signal, low-noise telemetry. Ensure Sysmon (Windows), auditd (Linux), or EDR command-line logging is actually capturing this on developer endpoints — a common blind spot.
Monitor upstream advisories. Track Anthropic's security communications, Johann Rehberger's publication at embracethered.com, and Simon Willison's coverage for updated bypass details and any vendor-issued guardrail improvements. Re-test your controls after every model or auto-mode update — guardrail regressions between model versions are a documented pattern in this space.
Add agent-behavior scenarios to your IR runbooks. Your incident response plan should answer: if Claude Code executed attacker-injected instructions on a developer laptop, what credentials must you rotate, what persistence do you hunt for, and what is the containment sequence? Build that playbook before you need it.

The broader lesson for security leaders: agentic AI tooling is privileged, non-deterministic automation making trust decisions on your behalf. It belongs in your threat model, your detection coverage, and your sandboxing strategy — today.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub