The classifier let the malware start and then refused to let Claude kill it

Security researcher Johann Rehberger published an attack against Claude Code Opus 5 running in Auto Mode on August 26. Nothing in the chain is a single forbidden action. Every step looks reasonable on its own, which is the point: Auto Mode judges steps, and the attack is built out of steps that individually pass.

How the chain runs

The server answers Claude's initial request with HTTP 415, which nudges it off the WebFetch tool and onto curl. What arrives through the redirect is a zip archive holding encoded records, a decoder binary, and a file named struct.py.

Claude then refuses to run the supplied decoder-darwin binary, on safety grounds. That refusal is the hinge of the whole attack. Rather than stop, Claude writes its own Python decoder and runs it inside the extracted directory, and that script imports base64.

Python resolves imports from the current directory first. base64 imports struct, so Python loads the attacker's struct.py out of the archive instead of the one in the standard library. The poisoned module runs obfuscated code at import time, spawns a child process, and that child downloads and executes a native payload which calls home and opens Calculator to prove it ran.

The part worth reading twice

Rehberger tested three variants, five runs each: the command-and-control chain succeeded three times, a variant using a Claude subprocess for reconnaissance three times, and a variant using a Claude subprocess for file writes four times.

The finding that matters is not the rate. In some runs Claude worked out that it had been compromised and issued a command to terminate the malware process, and Auto Mode blocked that command. The safety layer permitted the process to start and then stood between the agent and the cleanup.

• The classifier reads actions, and no action here is forbidden on its own.
• The dangerous step was written by Claude, not supplied by the attacker, so there was nothing malicious to recognize.
• Blocking is symmetric: a layer that stops harmful commands also stops remedial ones, because it cannot tell which is which.

What Anthropic said

Rehberger reported it to Anthropic's model bug bounty address and says he had no reply through that channel before publishing. The security team closed the report as informative, with a position that is worth quoting rather than paraphrasing: Auto Mode is a convenience feature backed by a best-effort classifier, not a security guarantee. Determined prompt injection chains built from benign-looking steps are not what the classifier is meant to stop, and the real boundary is operating system isolation and network egress control.

That is a coherent answer and it is also a reframing of what a default is for. Auto Mode is the default for Pro, Max and Team plans, and a default that most people will never read the documentation for is, in practice, whatever it appears to be. Anyone running a coding agent against untrusted content should be doing it in a container or a virtual machine, with restricted egress and credentials kept out of reach, which is what Rehberger recommends and what Anthropic points at.