Claude Code's 'Auto Mode' Beaten 80% of the Time by a Python Import Trick

Anthropic has been leaning heavily on "auto mode" as its answer to prompt injection in Claude Code — the failure mode where instructions hidden in a fetched file, webpage, or dependency hijack an agent's next action. On 14 August 2026 the company made auto mode the default for Pro, Max, and Team plans, backed by a striking statistic: in a third-party evaluation of 72 indirect-injection scenarios (720 attack attempts total) against Claude Fable 5, Opus 5, and Sonnet 5, none succeeded. A separate internal study reported auto mode catching 89% of harmful actions, against 13.6% for human reviewers (Simon Willison).

Two weeks later, prompt-injection researcher Johann Rehberger published a bypass that he says works roughly 80% of the time — a level of reliability that turns a theoretical weakness into a practical one, as reported by Simon Willison.

How the bypass works

The attack doesn't ask Claude Code to run anything that looks obviously dangerous. It gets the agent to download and decompress a zip archive as part of a plausible task, then run code that does nothing more alarming than import base64 — a harmless-looking standard-library import.

The catch is that Python's own base64 module imports struct internally. If the extracted archive has already dropped a file named struct.py into the working directory, Python's import resolution picks up that local file ahead of the genuine standard-library module — because the current directory sits early in sys.path. The agent never imports anything that pattern-matches as suspicious; the malicious code rides in on a dependency of a dependency it already trusts.

This is a variant of a well-known Python weakness — local module shadowing, cousin to dependency-confusion attacks — applied against an agent rather than a build pipeline. It sidesteps keyword- or intent-based safety checks because the surface action (importing base64) is entirely benign; the compromise happens one import frame deeper.

Why this matters more than a single bypass

The more uncomfortable detail is what reportedly happened after compromise: in some runs, auto mode itself blocked Claude from executing the cleanup commands needed to undo the damage, because those commands looked risky to the same safety layer that had just been defeated. A defence that can suppress its own remediation once bypassed is a single point of failure, not a second layer.

None of this means auto mode is worthless — catching a large share of naive injection attempts is real value, and Anthropic's own numbers suggest meaningful uplift over unaided human review. But an 80%-reliable bypass surfacing within weeks of a security feature going default-on is a reminder that model-judgement-based guardrails are probabilistic, not deterministic controls. Rehberger's own recommendation is the practitioner-grade one: run unattended coding agents inside containers, VMs, or OS-level sandboxes with restricted network egress, independent monitoring of agent actions, and credentials scoped tightly enough that a compromised session can't do much even if the agent-level defence fails.

The takeaway for teams running agentic coding tools

Treat any LLM-driven coding agent — Claude Code or otherwise — as running attacker-reachable code the moment it fetches an external file, package, or webpage. Guardrails built into the model or its harness are a useful first layer, but they should never be the only layer standing between an agent and your credentials, source tree, or production systems. Sandbox isolation, egress restriction, and out-of-band monitoring are the controls that hold even when the in-agent defence doesn't.