60-80% Attack Success Rate Exposes Claude Code Auto Mode as a Security Gap
Source
Researcher shows how Claude Code can be tricked simply by asking it to summarize a websiteThe Register / Anthropic
What happened
Researcher Johann Rehberger published findings showing that Anthropic's Claude Code, running the Opus 5 model in Auto Mode, could be compromised through a chained prompt injection attack with a 60 to 80 percent code execution success rate, as reported by The Register. The attack begins when a user asks the agent to summarize a third-party website; malicious content on that site then directs the agent to download a ZIP archive, exploit Python module shadowing, and ultimately spawn a fully autonomous child agent equipped with its own tool access. The attack chain requires no special privileges from the user and exploits no patched vulnerability -- it is a design-level exposure in how the agent handles untrusted external content. Critically, Anthropic described Auto Mode's underlying classifier as a best-effort feature rather than a security boundary, meaning the vendor does not represent it as a control enterprises can rely upon to satisfy their own security obligations. This finding extends a growing pattern of research showing that agentic tools with network access and code execution capabilities create attack surfaces that vendor-side guardrails alone cannot close, consistent with concerns raised in Zero-Click Prompt Injection Escapes Coding Agent Sandbox, Binary Overwritten and the AI Coding Assistant Introduced a Flaw That an AI Attack Agent Exploited in Five Days.
Why it matters
- ·Anthropic's public characterization of Auto Mode as a convenience feature rather than a security control removes any ambiguity about where the compliance boundary sits: enterprises that have been treating vendor-side classifiers as part of their agentic AI security program now have explicit confirmation from the vendor that this assumption is unsupported, and must document compensating controls to avoid an accountability gap in audits or incident inquiries.
- ·The attack's ability to spawn an autonomous child agent with independent tool access directly implicates AGT-001 (Agent Permission Boundaries) and AGT-004 (Agent Task Scope and Autonomy Limits), since the child agent inherits capabilities the original task scope was never intended to authorize -- a failure mode that enterprise control frameworks must now explicitly address for any coding agent with network access.
- ·With research such as Agentic AI Drives 36% Surge in Disclosed Vulnerabilities, Beazley Finds already on record, regulators and insurers are building a context in which documented failure to sandbox network-accessible agents will be difficult to defend; organizations operating Claude Code or similar tools in production developer environments without explicit sandboxing attestation face increasing exposure as this body of evidence accumulates.
Governance controls affected
What to do now
- ☐Audit every internal Claude Code deployment to confirm whether Auto Mode is enabled, and document whether network egress from the agent is restricted -- treat any unrestricted deployment as a high-priority remediation item.
- ☐Update your agentic AI security policy to reflect that vendor-provided classifiers and convenience safety features are not compensating controls, and require independent sandboxing, egress filtering, and task-scope enforcement at the enterprise layer.
- ☐Review your agent permission boundary documentation (AGT-001) to ensure child agent spawning is explicitly addressed: confirm that no child agent can inherit broader tool access than the parent task scope authorizes.
- ☐Add Claude Code and any comparable agentic coding tools to your next red-team cycle with a specific test case covering website summarization requests that include embedded prompt injection payloads.
- ☐Brief your vendor management team on Anthropic's stated position regarding Auto Mode so that future contract negotiations and vendor risk assessments reflect the actual security boundary the vendor is warranting.
What to watch next
Regulators and insurance underwriters tracking the accumulating body of agentic AI attack research are likely to begin referencing specific vendor statements -- such as Anthropic's classifier characterization -- when assessing whether enterprise deployers exercised reasonable care. Organizations should monitor whether the California SB 53 Foundation Model Safety and Security Protocol or comparable developer-side obligations begin to extend explicit requirements to agentic runtime classifiers, which would shift the vendor's current framing into a regulated disclosure problem. The MCP sandboxing baseline published earlier this year (see MCP Project Publishes Sandboxing Baseline for Enterprise Agent Deployments) offers a reference architecture that teams should evaluate against their current Claude Code configurations while awaiting further vendor guidance.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.