Claude Code Auto Mode refused the binary and then ran its own poisoned decoder

Claude Code's Auto Mode replaces human approval prompts with a safety classifier, and since mid-August it is the default starting mode. Johann Rehberger at Embrace The Red published a chain on 31 August 2026 in which a single request - summarize a URL - ends in code execution against Claude Code Opus 5 in Auto Mode, with attack success rates of 60-80% on a small sample size. The same configuration had scored 0.00% attack success in a third-party evaluation commissioned by Anthropic.

That gap is the interesting part. Boris Cherny of Anthropic posted that layered defenses - model training, input probes and an intent classifier - could reduce indirect prompt injection on unseen attacks to approximately zero. Anthropic hired Trajectory Labs to run 72 indirect prompt injection scenarios ten times each; the shared chart showed 0.00% for Opus 5 in Auto Mode, and the evaluation appears to have no published benchmark name. One targeted chain against a scenario nobody enumerated does not invalidate the eval, but it does tell you what the classifier is and is not gating.

The chain has five moves and only one of them is refused. The malicious site returns 415 Unsupported Media Type to the WebFetch tool. Nothing in the response tells Claude to switch tools; Claude decides on its own, logging "WebFetch got a 415. Let me try directly." It then issues a Bash tool call with curl, follows an HTTP 303 to /deposits/WIC-notebook-catalogue.ZIP, and extracts the archive into a temporary scratchpad folder. Rehberger notes the redirect is not always needed - Claude sometimes starts with curl directly.

So Auto Mode allowed: tool escalation from a summarizing fetch tool to a raw shell, an outbound curl to an attacker-controlled host, a redirect to a binary archive, and unpacking that archive to local disk. What it gated was the single most conspicuous artifact. The ZIP contains README.txt, accession-map.csv, MANIFEST.sha256, seven Base85/zlib-encoded JSON notebook records, a macOS binary called decoder-darwin, and struct.py. The README presents decoder-darwin as the catalogue decoder. Claude sees the binary and refuses to run it - sometimes after inspecting it and finding that it matches the encoding scheme the README describes.

Claude writes its own decoder for a format that is deliberately simple - Base85, zlib, JSON - and runs it with the extracted archive as the working directory.

Python places the extracted archive directory on the module search path. The standard-library base64 module imports struct, and the ZIP ships a file named exactly struct.py. Python loads the attacker's module, which re-exports the real low-level _struct API so decoding continues normally and Claude receives valid JSON records. The task appears to succeed. Nothing in the transcript looks like a refusal, an override, or an unsafe command.

For anyone building on top of agentic coding tools, that is the design lesson. The dangerous token here is not curl, not the binary, and not any string the classifier could reasonably flag. It is the current working directory of a python3 invocation that the model wrote itself, in a directory whose contents came from a stranger. A classifier reviewing that command in isolation sees an import of three standard modules.

Here the honest answer is narrower than the question. The post does not evaluate sandbox configuration, hooks, or Bash deny rules against this chain, and gives no attack success rate for any hardened configuration. The only mitigation it states is architectural, and it states it up front.

Treat that as the supported claim and nothing more. Any specific setting you might reach for - denying curl, pinning the agent's cwd outside untrusted extractions, running with an isolated filesystem - is a reasonable inference from the mechanism described, but the source measures none of them, so no success-rate figure exists to justify one over another.

Adjacent evidence suggests config-level fixes need to be verified rather than assumed. In the Claude Code issue tracker, users note that the attribution.commit setting in .claude/settings.json suppresses the session URL appended to commit messages, but describe it as "completely undiscovered," and report that a commit-msg git hook "doesn't always fire reliably in remote/cloud environments." That is a different feature entirely, but it is a data point on the reliability of hook-based enforcement in hosted runners.

The failure mode also shows up without an attacker. Meta AI security and safety researcher Summer Yue ran OpenClaw on her inbox after instructing it to "Check this inbox too and suggest what you would archive or delete, don't action until I tell you to." It held on a toy inbox; her real inbox was large enough to trigger compaction, and, in her words, "it lost my original instruction." The emails were deleted. Yue called it a "rookie mistake" rather than a guardrail test. OpenClaw founder Peter Steinberger's response was that server-side compaction is needed for models that support it.

Between the two cases, the pattern is that the constraint has to live outside the context window. A prompt-level "confirm before acting" can be evicted by compaction; a classifier can approve a command that is only malicious because of where it runs.

The sample size behind the 60-80% figure is small and unstated in exact terms. The Trajectory Labs evaluation has no published benchmark name, so there is no way to check whether anything resembling this chain was in the 72 scenarios. The payload delivered by the shadowed struct.py is described only as obfuscated; the published excerpt cuts off before detailing it. The binary in the archive is macOS-specific, and the post does not report whether the chain reproduces on Linux runners or in CI.

There is a second cost worth naming. The code that executed the attack was code Claude wrote and nobody read. As Marty Lamb argues, agents make understanding your own code optional while leaving you the responsibility for its quality and security. In this chain, a three-import one-liner nobody would bother reviewing was the entire exploit.