Prompt injection hijacks Claude Code Auto Mode 80% of the time
A 'summarize this site' request runs remote code in Auto Mode; Anthropic calls it best-effort, not a guarantee. Plus Copilot's Sept billing shake-up.
Copy markdown
The attack: one 'summarize this website' request
Researcher Johann Rehberger showed an indirect prompt injection that makes Claude Code fetch a zip, then abuses Python module shadowing: when Claude's own decoder runs `import base64`, Python loads the attacker's `struct.py` from the extracted folder and executes remote code with a C2 callback. It landed in 3 of 5 to 4 of 5 runs (60-80%).
Auto Mode blocked the cleanup, not the breach
Auto Mode - Claude Code's default since mid-August - swaps manual approvals for an automated safety classifier. In testing, Claude detected the compromise but Auto Mode blocked its own cleanup command. The tell, per Rehberger: Claude won't trust a supplied binary decoder, but it trusts the replacement it writes itself.
From 0.00% to 80%
Anthropic had highlighted tests where Opus 5 Auto Mode hit a 0.00% prompt-injection success rate on a fixed scenario set; a real-world chain broke it 60-80% of the time. Anthropic closed the report as 'Informative,' calling Auto Mode best-effort protection - not a security guarantee - with the real boundary at OS isolation and network controls.
What to actually do now
Treat Auto Mode's approval as convenience, never as confirmation. Run unattended agents in a container, VM, or OS sandbox; restrict network egress; and keep home directories, SSH keys, and cloud credentials out of the agent runtime - especially anything that fetches or summarizes untrusted URLs.
Elsewhere: Copilot's September billing and policy shake-up
GitHub confirmed that from Oct 1, new Copilot Business/Enterprise seats must be paid before users get access (no more assign-then-bill). From Sep 28, three Copilot chat surfaces merge into one, chat-data retention jumps from 28 days to your account's lifetime, and code review's default effort shifts from Lite to Balanced.