Prompt Injection in Claude Code Opus 5 Enables Remote Code Execution

A security researcher has uncovered a critical prompt injection vulnerability in Claude Code's 'Auto Mode' when using the Opus 5 model. The flaw allows an attacker to achieve remote code execution (RCE) on a user's machine, bypassing the tool's internal safety mechanisms.

Johann Rehberger of Embrace the Red discovered the attack is triggered when a user asks the agent to summarize a malicious website. By embedding hidden instructions within the external page, Rehberger hijacked the agent to execute arbitrary code. He reported a success rate of 60% to 80% within a small sample size, demonstrating that the agent can be reliably manipulated into performing unauthorized actions.

The Failure of Auto Mode

Claude Code is a developer tool capable of editing files and executing system commands. To reduce friction, Anthropic introduced 'Auto Mode,' which has served as the default starting mode since mid-August. This mode replaces the traditional 'human-in-the-loop' approval process—where a user must manually confirm every command—with an internal safety classifier.

This classifier determines if a tool call is safe to execute automatically. Consequently, the security burden shifts entirely onto the model's ability to distinguish between legitimate user intent and malicious injected instructions. In this instance, the classifier failed to block the RCE attempt.

Industry Implications

This discovery highlights a significant gap between theoretical safety benchmarks and real-world exploitation. Prior to this finding, a third-party evaluation commissioned by Anthropic reported a 0.00% success rate for prompt injection attacks against Opus 5 in Auto Mode. The fact that a researcher achieved a success rate as high as 80% suggests that the safety classifier is insufficient for protecting users from indirect prompt injections.

Because Auto Mode is the default setting, the vulnerability exposes a wide array of developers to RCE risks. The mere act of asking an AI agent to interact with or summarize an untrusted external webpage could lead to a full system compromise, undermining the trust required for the widespread adoption of autonomous coding agents.

What's Next

Industry observers are now watching to see how Anthropic updates its safety classifier or whether the company will revert to requiring human approval for sensitive tool calls. While the vulnerability has been demonstrated, the full extent of the exploit's reach across different environments remains to be seen. For now, the incident serves as a stark reminder that automated safety layers are not a substitute for explicit human oversight in tools with system-level access.