Rehberger breaks Claude Code auto mode with an 80% reliable prompt injection

Johann Rehberger got Claude Code's auto mode to download a zip archive and run malicious code hidden in a local struct.py, loaded silently by an `import base64` — an attack he clocks at roughly 80% success. The sharper finding is the guardrail inverting: Claude noticed the compromise and tried to kill the malware process, but auto mode denied the cleanup command. Rehberger's mitigations are the ones that hold — run unattended agents in a container, VM, or OS sandbox, restrict network egress, monitor them, and keep home directories, SSH keys, and cloud credentials out of the agent runtime.

Source: simonwillison.net ↗