According to Simon Willison, writing on 27th August 2026, Anthropic has made Claude Code's 'auto mode' the default protection against prompt injection attacks for its coding-agent users and has made claims about its effectiveness. Prompt injection researcher Johann Rehberger reported an attack against auto mode that he says works about 80% of the time. Per the account, the attack tricks Claude Code into downloading and uncompressing a zip archive, then executing code that imports base64 without noticing that this action imports and executes a local struct.py file extracted from the archive. Willison writes that in some runs the safety mechanism itself became part of the failure: the classifier allowed the malware process to be created, but then blocked the command intended to stop it. In those cases, when Claude detected the compromise and tried to terminate the malware process, auto mode denied the cleanup command. Willison states he agrees with Rehberger's conclusion that the only safe way to run agents where there is any risk of an adversarial attack is within a sandbox. The report comes from a single independent source citing Rehberger's research; Anthropic's response is not included in the excerpt.
- Rehberger reports the attack succeeds roughly 80% of the time
- The attack extracts and executes a struct.py file via a zip archive and a base64 import
- In some runs auto mode blocked Claude's own cleanup command after detecting the compromise
- Recommended mitigation is running agents inside a sandbox
What it means for you
The built-in safety feature that Anthropic turned on by default for its coding agent was reportedly defeated most of the time by a researcher, and in some cases it even blocked the agent from cleaning up malicious code it had already spotted. In plain terms: if you let an AI coding agent run commands on your machine automatically, its own guardrail is not something you can fully rely on. The safer approach is to run these agents in a sandbox — an isolated environment where any damage stays contained.
Try this
If you use Claude Code or a similar agent that runs commands automatically, run it inside a container or a throwaway virtual machine this week, so nothing it does can touch your real files or credentials.
Who should care
Developers and small teams using Claude Code or any coding agent with automatic command execution, especially when handling untrusted files, repos, or downloads.
Skip this if
You don't use autonomous coding agents, or you already run them in an isolated sandbox with no access to sensitive data.
Sources: Simon Willison — read the original