Claude Code's "Auto Mode" Stopped Working on Day 19 — And Then It Blocked Claude's Own Cleanup
发布于 2026-09-01
On August 27, 2026, a prompt-injection attack against Claude Code's Auto Mode worked 80% of the time. The story isn't the 80% — it's that Auto Mode refused Claude's own attempt to terminate the malware it let through. A classifier is not a security boundary.
Claude Code's "Auto Mode" Stopped Working on Day 19 — And Then It Blocked Claude's Own Cleanup
On August 27, 2026, prompt-injection researcher Johann Rehberger published an 80% success-rate attack against Anthropic's Claude Code Opus 5 Auto Mode — the safety layer that became the default on August 8. The headline is not the 80%. The headline is that when Claude finally noticed the compromise and tried to terminate the malware, Auto Mode blocked the cleanup command. The safety mechanism stopped the defender.
Nineteen days. That is how long it took for "default-safe" to become "safe-mechanism-turned-against-itself."
The attack: legitimate commands doing dirty work
The exploit chain looks innocent. Rehberger convinces Claude Code to download a zip archive, unzip it, and run import base64. Three steps. None of them look like malware on their own. Downloading a file: normal. Unzipping: normal. Importing a Python standard-library module: textbook.
The trick lives inside Python's import mechanism. When Python resolves import base64, it walks the current working directory first. base64 itself is in the standard library, but base64 internally depends on struct — and if a struct.py is sitting in the cwd, Python silently executes that local file before reaching the real one.
You think the front desk just handed you a key card. They also called you a cab.
This is not a brand-new vulnerability. The Python community flagged cwd import side-effects years ago. The real problem is that Claude Code does not isolate the working directory between unzip and import. That's a missing runtime boundary, not "Claude was not smart enough to notice."