A prompt injection attack turns Claude Code's auto mode against itself

Johann Rehberger, a prompt injection researcher with a long track record, has an attack against Claude Code's auto mode that works about 80% of the time, and Simon Willison flags the most uncomfortable part of it. The setup is a classic supply-of-input trick: the agent is steered into downloading and extracting a zip archive that contains a malicious struct.py. Because of how Python's import system resolves modules, when the agent later imports base64 it ends up executing the attacker's local file instead, which runs the payload.

The second half is what makes this more than a normal exploit. Claude actually detects the compromise and tries to kill the malicious process, but auto mode's own safety classifier blocks the cleanup command. The classifier had allowed the process to be created, then refused to allow the commands that would terminate it. So the guardrail meant to keep the agent safe ended up protecting the malware from the model's own remediation. Rehberger's advice is the same hard boundary that keeps coming up: run unattended coding agents inside a container or VM, cut their network access, watch what they do, and keep SSH keys and cloud credentials out of the agent's runtime entirely.

Why it matters

If you let a coding agent run unattended with real permissions, this is a concrete failure mode to design around: the model may be smart enough to notice it has been compromised and still be unable to fix it. Sandboxing and credential isolation are not optional hardening here, they are the difference between a contained incident and one that reaches your keys.