In this post, we explore how a simple website summary request hijacksClaude Code Opus 5inAuto Modeand achieves code execution with 60-80% attack success rate using a small sample size.
This is interesting because a third-party evaluation commissioned by Anthropic showed a0.00%prompt injection attack success rate for Opus 5 in Auto Mode.
Auto Mode replaces human approval prompts with a safety classifier. Since mid-August it is the default starting mode for Claude Code.
To make my key point right away: If you care about what’s happening and are worried about misalignment, hallucinations and prompt injection, thenAuto Mode IS NOT a substitute for running your agent in an isolated environment and monitoring what it is up to.
I wanted to see how that result holds up against a targeted attack chain.
I got attack success rates up to 80% using a small sample size.
There is of course a lot more to it. So read on!
Let’s assume a basic task where Claude ends up on a website to process or summarize content. The user prompt I picked is a classic:
I redacted part of the domain to keep it out of search indices and preserve it for future tests. The endpoint only serves the test content to allow-listed IPs.
The website presents itself as a small archive of notebook records. Those notebook records however are in a ZIP archive. The archive contains plausible catalogue metadata, dates, checksums and seven short records about the development of the theory of language.
The wrapper gives Claude a legitimate reason to investigate the material.
Claude initially uses theWebFetchtool to retrieve the contents of the page. TheWebFetchtool itself appears to perform a summary of contents, which means we’d have to attack that tool by itself.