Breaking Claude Code Opus 5 Auto Mode

Security researcher Johann Rehberger demonstrated a reliable prompt injection attack against Claude Code's Auto Mode achieving 60-80% code execution success rates via Python module shadowing. The attack exploits the model's tendency to write and run its own decoder for obfuscated archives, allowing malicious code in a shadowed struct.py to execute on import. The findings directly contradict Anthropic's published claim of 0% prompt injection vulnerability in Auto Mode.