Anthropic leans on Claude Code’s auto mode as the primary defense against prompt injection, the class of attack where instructions hidden in a file, webpage, or archive hijack an AI agent’s actions. The company made auto mode the default setting earlier this month and has promoted its effectiveness. Simon Willison, writing on his blog, points to a new demonstration that undercuts that confidence.
Prompt injection researcher Johann Rehberger built an attack that Willison describes as working roughly 80 percent of the time. The exploit gets Claude Code to download and unpack a zip archive, then run code that imports Python’s base64 module. Buried in that same archive sits a file named struct.py. Because Python resolves local modules before standard library ones, the import silently pulls in the malicious local file instead, and the agent executes it without recognizing the substitution.
The failure gets worse once the compromise is underway. In several of Rehberger’s runs, Claude noticed the malware process it had launched and tried to kill it. Auto mode blocked the cleanup command. The classifier that let the malicious process start in the first place also stopped the agent from stopping it, turning the safeguard itself into a second point of failure.
Willison, who has spent years cataloguing prompt injection failures across the industry, says he agrees with Rehberger’s conclusion rather than disputing it: a classifier or mode setting cannot be trusted as the sole defense when an agent might face an adversarial actor. His recommendation is operational rather than architectural. Isolate any coding agent that runs without supervision inside a container, VM, or OS-level sandbox. Restrict the agent’s network egress. Monitor what the agent does while it runs. Never give the agent access to home directories, SSH keys, or cloud credentials.
That recommendation matters because prompt injection has no known general fix. Every lab, including Anthropic, has shipped detection layers and heuristics, but none has produced a mechanism that reliably distinguishes an attacker’s embedded instructions from the user’s own. Betting a default safety setting on a classifier is a wager that the classifier keeps pace with attackers like Rehberger, not a structural guarantee. A sandbox with restricted egress is a boundary that holds even when the classifier fails.
Teams running Claude Code’s auto mode against untrusted inputs, scraped web content, downloaded packages, third-party repositories, should treat it as a convenience layer, not a security boundary, and isolate the agent’s execution environment accordingly before the next unattended run.
Simon Willison, writing on his blog on August 27, 2026, citing security researcher Johann Rehberger’s findings.
