The Auto Mode protection in Claude Code Opus 5 turned out to be vulnerable. Strictly speaking, this is not a classic prompt injection: Willison calls it an attack through the agent's environment (confused environment attack). Researcher Johann Rehberger found an attack that, according to him, works in 80% of cases. The vulnerability calls into question how safe and predictable agent behavior really is, especially in critical pipelines.
Here is how the attack works: the agent downloads and unpacks a ZIP archive, then runs code that imports base64. Claude Code does not notice that importing base64 also pulls in a local struct.py file extracted from the archive. The most alarming part: in some cases the Auto Mode protection itself blocked cleanup commands after the agent detected the compromise. In other words, the security system let the malicious code through and then got in the way of stopping it!
For me, this confirms an old principle: any system that handles external, potentially hostile input has to be isolated. If you build agent pipelines that may run into prompt injections or have to process untrusted code, here is Johann Rehberger's conclusion, which Simon Willison agrees with: if there is a risk of being targeted, the only safe way to run agents is in a sandbox. This is about more than reliability. It is the foundation for bringing AI into serious business processes.
Read more about the attack in Simon Willison's write-up.