What's this about?
Johann Rehberger took a plain user request — "summarize this website" — and used it to get code execution out of Claude Code Opus 5 running in Auto Mode, with a 60–80% success rate on a small sample. The reason this matters is the comparison: a third-party evaluation commissioned by Anthropic and run by Trajectory Labs across 72 indirect prompt-injection scenarios, ten times each, reported 0.00% attack success for Opus 5 in Auto Mode. His own conclusion is the one to take away: Auto Mode is not a substitute for running your agent in an isolated environment and watching what it does.
What is Auto Mode?
Claude Code used to stop and ask you before running a command. Auto Mode replaces that human approval prompt with a safety classifier — a model that decides whether the action is acceptable. Since mid-August it is the default starting mode. The trade is real: constant approval prompts train people to click yes without reading, so automating the judgement is a genuine improvement over that. The failure mode is different, though: a classifier can be reasoned around, and unlike a human it never gets suspicious.
What's the community saying?
- The most common first reaction is surprise that this isn't seen more in the wild — followed by the observation that we might simply not know when it happens.
- The sharpest framing of why the vendor number is dangerous: Auto Mode gives people a false sense of security that leads them to skip the sandbox. The same attack inside a sandbox, even in YOLO mode, would be comparatively harmless.
- A practitioner's note that Auto Mode instructions are easy to bypass in ordinary use, never mind adversarially — you tell it "always ask before deploy" and then a model update or a model switch quietly stops honouring it.
- The bleak version: "what vibe coder who doesn't even read it would notice if this happened?"
- A dissent worth keeping: the attack is nicely designed but arguably not specific to Auto Mode — it is a trojan tailored to Claude's habits, and many of the same limits apply.