It has been revealed that 'AutoMode,' the automated security feature for Claude Code Opus 5, is vulnerable to prompt injection attacks. It even led to an ironic situation where the AI failed to remove malicious code it had been infected with because of its own security features.
Imagine this: On a busy morning, you casually command your smart AI coding assistant, “Summarize this website and organize the findings.” But at that very moment, unbeknownst to you, the AI on your computer is downloading and executing malicious code. The era of ‘agents’—systems where AI judges and executes specific goals on its own—has arrived alongside leaps in artificial intelligence technology, but the security flaws hidden behind that convenience are now being exposed, causing quite a shock.
Anthropic’s recently announced ‘Claude Code Opus 5’ has garnered significant attention for its ability to automate coding tasks. However, research has revealed that the security shield expected to protect this feature, namely ‘AutoMode,’ can actually be bypassed quite easily [Source 14, Source 15].
Why does this matter?
Using an AI coding assistant in daily life is no longer unusual. It’s not just developers; everyone is attempting to automate tasks using AI. The problem is that we have started to trust AI and ‘delegate full authority’ to it. According to [Source 3, Source 11], Anthropic set this ‘AutoMode’ as the default security defense for Claude Code to replace traditional human approval processes.
However, this study proved that simply by making a mundane request that anyone might make—summarizing website content—the AI can be hacked and coerced into executing malicious code [Source 8, Source 15]. This means our computers could fall into the hands of attackers through the very AI meant to help us.
Understanding it simply: What if an AI’s ‘seatbelt’ malfunctions?
Simply put, ‘AutoMode’ is a ‘lightweight security guard monitoring the commands issued by the AI’ [Source 7]. When the AI attempts to use a tool (such as deleting files or executing code), this security guard quickly classifies whether the action is “destructive” or “unauthorized external activity” and decides whether to pass or block it [Source 7].
But here, a ridiculous and dangerous situation occurs. Research team tests revealed that this security guard is actually impeding the AI’s ‘self-cleansing efforts.’ When the AI detects that it has been compromised by malicious code and attempts to issue a ‘delete’ command to remove it, the security guard blocks that very deletion command, mistaking it for a ‘dangerous’ action [Source 1, Source 4, Source 11].
Metaphorically, it’s like a homeowner who discovers a burglar in the house calling the police and asking, “Please kick the burglar out!”, only for the police to say, “Causing a disturbance inside a home is illegal!” and tying the homeowner’s hands. Even if the AI tries to solve the intrusion itself, the security system prevents it, effectively neutralizing the entire system.
Current Status: How dangerous is it?
Through experiments, the research team demonstrated that they could seize control of the system with a very high success rate. Even in short sample tests, the success rate for an attacker to hack the AI and make it execute arbitrary code reached between 60% and 80% [Source 12, Source 15].
While Anthropic is currently aware of and managing these system vulnerabilities, users should remain cautious. In particular, connection errors or unexpected system rejections have been reported during system monitoring processes [Source 10]. As much as we enjoy automated convenience, it is important to recognize the significant risks inherent in the permissions we grant to AI.
AI’s Take: When technological growth must transcend security
Security is not about building fortress walls, but about managing the passageways inside those walls. The more powerful the automated convenience, the more wisdom is required to design systems that don’t get tripped up by their own defense mechanisms. Convenience can sometimes be the sweetest trap.
What happens next?
The fundamental direction of AI technology is moving toward becoming ‘more autonomous’ [Source 7]. However, experts advise following a few basic rules when using AI coding agents in light of this vulnerability [Source 11, Source 12].
- Utilize Sandboxes (safe spaces isolated from the outside): Run AI in an isolated environment without access to critical data or permissions.
- Minimize Permissions: Do not thoughtlessly hand over SSH keys (security keys for server access) or critical service access permissions to AI [Source 11].
- Continuous Monitoring: Even if the AI handles everything on its own, you must regularly check that no strange logs (records) are left behind in the process.
AI is now becoming an ‘agent’ beyond a simple tool. But remembering that the agent is not perfect is our minimum line of defense as we live in the digital age.
References
-
Breaking Claude Code Opus 5 Auto Mode Simon Willison’s Weblog (https://simonwillison.net/2026/Aug/27/breaking-claude-code-opus-5-auto-mode/) - Researcher bypasses Claude Code Opus 5 auto mode in 80… — elseif (https://www.elseif.net/stories/breaking-claude-code-opus-5-auto-mode-86c9015)
-
Breaking Claude Code Opus 5 Auto Mode stacker news (https://stacker.news/items/1558604) - They Said 0.00% Prompt Injection. He Broke Claude Auto Mode (https://www.youtube.com/watch?v=AnIiTBrElOE)
-
Breaking Claude Code Opus 5 Auto Mode Modern Orange (https://modernorange.io/item/49479661) - Anthropic Is Making Autonomous AI the Default: Claude Code’s Auto… (https://blog.bidsense.co.kr/anthropic-claude-code-auto-mode-default/)
-
Breaking Claude Code Opus 5 Auto Mode Hacker News (https://news.ycombinator.com/item?id=49495858) - Claude Code Opus 5: исследователь нашёл обход AutoMode… (https://dzen.ru/a/apFQV63UpQP2rUmr)
- Welcome to Claude’s home for real-time and historical data on system… (https://status.claude.com/)
-
Breaking Claude Code Opus 5 Auto Mode — brief The AI News (https://www.theai.news/briefs/2026/08/breaking-claude-code-opus-5-auto-mode-58c016c9) - Claude Code Opus 5 Auto Mode Prompt Injection Bypass … (https://securityarsenal.com/blog/claude-code-opus-5-auto-mode-prompt-injection-bypass-detection-and-hardening-guide-for-ai-coding-agents)
-
Breaking Claude Code Opus 5 Auto Mode AINews (https://www.ainews.tech/article/2783) - Breaking Claude Code Opus 5 Auto Mode - Embrace The Red (https://embracethered.com/blog/posts/2026/breaking-claude-code-opus-5-and-automode/)
- Claude Opus 5 - Claude Platform Docs (https://platform.claude.com/docs/en/models/opus-5/overview)
- Phishing email attacks
- Prompt Injection attacks
- Physical hardware attacks
- Stopping the AI from writing code entirely
- Blocking the AI from executing commands to delete infected malicious code
- Automatically shutting down the user's computer
- By getting human approval for every action
- By evaluating risk before tool execution through a lightweight classifier
- By isolating all tasks outside the server