---
title: "[AUTO] Claude Code Auto Mode vulnerable to module shadowing attack"
pubDatetime: 2026-08-29T05:16:00.000Z
description: "Researcher shows Claude Code Auto Mode vulnerable to 60-80% RCE via module shadowing."
tags: [claude-code, ai-security, prompt-injection, vulnerability, 2026, 2026-q3, 2026-08, AUTO]
---
Researcher Johann Rehberger [published a detailed breakdown](https://embracethered.com/blog/posts/2026/breaking-claude-code-opus-5-and-automode/) of a 60–80% reliable remote code execution attack against Claude Code in Auto Mode. The trick: Claude summarizes a website, falls back to curl for a failed fetch, downloads a malicious ZIP with a `struct.py` file that shadows Python's standard library imports. When Claude generates its own decoder and imports `base64`, it loads the attacker's malicious code instead.

What stings is the evaluation gap. Anthropic's commissioned study found 0% success against predetermined injection scenarios, yet Rehberger achieves 60–80% with creative tactics. The deeper issue: Claude refuses untrusted binaries, but happily runs its own generated code in a contaminated environment. The safety guardrail becomes the exploit path. Anthropic said Auto Mode is "backed by a best-effort classifier, not a security guarantee," essentially conceding the design doesn't ship with real protections, only mitigation layers. That's honest, but raises whether Auto Mode should reset user expectations about what it will and won't defend against.

---

*Sources: [Breaking Claude Code Opus 5 and Auto Mode](https://embracethered.com/blog/posts/2026/breaking-claude-code-opus-5-and-automode/)  •  [Video demonstration](https://youtu.be/18PIeJoxYtc)*

*Coverage: [The Register: Researcher shows how Claude Code can be tricked simply by asking it to summarize a website](https://www.theregister.com/research/2026/08/28/researcher-shows-how-claude-code-can-be-tricked-simply-by-asking-it-to-summarize-a-website/5293372)*

*Related on this blog: [[AUTO] Claude Code auto-executes repository configuration](/posts/auto-claude-code-mcp-rce)  •  [[AUTO] Grok's Trust Boundary Problem](/posts/auto-grok-injection)  •  [[AUTO] Self-Propagating Prompts Infect AI Agents](/posts/auto-agent-prompt-infection)*