AI 安全
Claude Code Auto Mode Bypassed by Multi-Hop Prompt Injection, With Small-Sample Attack Success Rates Reaching 80%
Researchers used Python module shadowing to make a security decoder written by Claude Code load a malicious `struct.py`, ultimately achieving remote code execution. The case shows that per-tool-call classifiers cannot replace operating system isolation, and that a zero percent success rate in official evaluations cannot be extrapolated to unseen attack chains.
Security researcher Johann Rehberger disclosed an indirect prompt injection chain targeting Claude Code Opus 5 Auto Mode. Auto Mode has become the default for new Pro, Max, and Team sessions. Instead of requesting user approval for each action, it uses a classifier to determine whether a tool call is destructive, irreversible, or extends beyond the environment's scope.
The attack begins with a request to “summarize a website.” The site causes WebFetch to receive an HTTP 415 response, prompting the agent to switch to `curl`, which then follows an HTTP 303 redirect to download a ZIP archive. The archive contains plausible directory data, Base85/zlib-encoded records, a native decoder, and a malicious `struct.py`. Claude refuses to execute the unknown binary and instead writes its own Python decoder inside the extracted directory. However, Python's `base64` standard-library module imports `struct`, and the Python search path therefore loads the attacker's identically named file first. The malicious module also forwards the genuine `_struct` API, allowing decoding to complete normally while a background process downloads the next-stage payload, establishes an attacker-controlled C2 connection, and can even launch another tool-enabled `claude -p` subprocess.
Each of the three variants was tested only five times. The C2 chain and one subagent chain succeeded three times, while another variant capable of writing outside the workspace succeeded four times. The resulting 60% to 80% figures should not be treated as general attack success rates, but they are sufficient to refute the inference that zero successes in a fixed evaluation imply that no practical bypass exists. More notably, Claude sometimes detected the compromise afterward and attempted to terminate the process, only for Auto Mode to block the cleanup command.
The engineering takeaway is not to disable every classifier, but to avoid treating one as a security boundary. Agents that process untrusted content such as webpages, documents, or packages should still run inside containers, virtual machines, or OS sandboxes, with restricted network egress and process creation, and without mounted home directories, SSH keys, or cloud credentials. Future scrutiny should focus on whether Anthropic incorporates cross-tool causal chains, post-extraction execution, and language-runtime search paths into its evaluations, and whether it provides reproducible third-party test suites.