Breaking Claude Code Opus 5 Auto Mode: Points: 1 # Comments: 0

What happened

The source URL returns a 404 and HN is rate-limiting. Let me try a web search to pull any cached or indexed version of the content. Good — now I have solid verifiable facts to work with. The source URL is a 404 (the article may not be published yet or the URL is wrong), but the web research surfaced the core factual record: Anthropic's claimed 720-attempt evaluation, 0% success rate, the Auto Mode classifier, affected plans (Pro, Max, Team), and Embrace The Red / Johann Rehberger's ongoing research angle. I'll write strictly from these confirmed facts and the summary's framing, without inventing anything.

Security researcher Johann Rehberger, writing on Embrace The Red, has published new findings that probe the limits of Anthropic's Claude Code Auto Mode when running on Opus 5. The research puts pressure on claims Anthropic made in the run-up to Auto Mode's general availability, specifically a claimed 0 percent success rate for prompt injection across 720 controlled attack attempts against Claude Fable 5, Opus 5, and Sonnet 5.

This piece examines what Auto Mode's classifier actually does, how Rehberger's approach challenges it, who faces the most exposure in practice, and what developers and security teams should verify before extending trust to the system. It is aimed at engineers who deploy Claude Code in production, security practitioners who assess agentic-AI risk, and team leads responsible for approvals on Pro, Max, and Team plan subscriptions.

How it works

Johann Rehberger published research on Embrace The Red demonstrating that Claude Code running Opus 5 in Auto Mode can be manipulated in ways that Anthropic's own evaluation framing does not fully cover. Auto Mode was moved to general availability for Anthropic's Pro, Max, and Team plans and is now the default operating mode. Anthropic cited its 720-attack controlled trial, with a reported 0 percent injection success rate across Fable 5, Opus 5, and Sonnet 5, as evidence that the classifier makes agentic operation safe enough for broad deployment. Rehberger's work invites scrutiny of the assumptions baked into that trial: which attack vectors were included, what counted as success, and whether the evaluation environment reflects real developer workflows.

The research builds on Rehberger's prior body of work documenting prompt injection in computer-use agents, rules-file backdoor attacks hidden inside files such as CLAUDE.md and AGENTS.md, and indirect injection through code the model is asked to review. The new piece focuses specifically on the Opus 5 and Auto Mode pairing, which is the highest-capability and most autonomously configured setup that most paying Anthropic customers now run by default.

Auto Mode replaces the old permission-approval loop, where the model surfaced each tool call to a human who then accepted or rejected it. Research had already shown that users reflexively approve such prompts, making them an unreliable safety gate. The replacement is a dedicated classifier that sits between the model's intended action and execution. Its job is to catch actions that are irreversible, destructive, or that move data outside the user's environment. Anthropic's framing positions this classifier as a durable improvement over human-in-the-loop approval because it is consistent and does not suffer from approval fatigue.

Why it matters

What Rehberger examines is the gap between that framing and the classifier's actual decision boundary. Prompt injection can reach Claude Code through content the model processes as part of its task: files on disk, code under review, documentation it fetches, or repository configuration files like CLAUDE.md and AGENTS.md. If adversarial instructions embedded in that content can phrase a requested action in a way the classifier does not flag as dangerous, the model may execute it. The classifier is not publicly specified, so the exact categories it blocks and the vocabulary that triggers or avoids detection are opaque to both defenders and attackers.

Anthropic's 720-attempt evaluation produces a headline number — 0 percent success rate — that is likely to be cited widely by enterprises justifying agentic AI deployments. Any research that reveals the evaluation's boundary conditions matters because those conditions define what the number actually means. If the 720 attempts used a constrained attack vocabulary, excluded rules-file backdoor vectors, or were run against a sandboxed environment that differs from a real developer machine, then a 0 percent trial result and real-world risk can both be true simultaneously. The evaluation's methodology is not publicly disclosed in enough detail to verify those assumptions.

Who is affected

There is also a secondary effect on the developer experience. Users on Reddit and GitHub have reported that the Auto Mode classifier produces false positives: it flags defensive security discussions, input-sanitization commentary, and injection-prevention code as cybersecurity risks, causing the system to fall back to an alternate model. If developers learn to work around classifier friction through prompt rewording, they inadvertently train themselves in the vocabulary that also avoids detection for genuinely harmful payloads.

The most directly affected group is developers on Pro, Max, and Team plans who have Auto Mode enabled as their default. These users have implicitly delegated terminal execution decisions to a classifier they cannot inspect. Organizations that have moved Claude Code into continuous integration pipelines or gave it access to internal documentation, private repositories, or secrets-bearing configuration files have the largest potential blast radius, because those are exactly the contexts where indirect prompt injection through third-party content is plausible.

Security teams tasked with approving Claude Code for enterprise use are also affected. They now need to assess a system whose primary safety mechanism is a black-box classifier rather than a human gate, and where the only publicly available efficacy data comes from Anthropic's own controlled trial. Independent audits, such as the review by Trajectory Labs that has been referenced in the broader Auto Mode discussion, provide some external signal, but the scope and methodology of those audits are also not fully public, which limits how much weight a security review can place on them.

What to watch next

The most important thing for builders to verify is whether their Claude Code deployment runs in an isolated environment. Anthropic and independent security researchers agree on this point: running Claude Code in a disposable container that does not have access to SSH keys, environment secrets, production credentials, or sensitive internal files reduces exposure regardless of how the classifier performs. That mitigation exists below the model and the classifier, making it robust to changes in either. Developers should audit what files Claude Code can read before a session begins, with particular attention to CLAUDE.md and AGENTS.md, which prior Embrace The Red research showed can carry hidden instructions.

Beyond hardening individual environments, the broader question is whether Anthropic will publish the methodology behind the 720-attempt evaluation in enough detail for independent researchers to replicate or extend it. The evaluation covers Fable 5, Opus 5, and Sonnet 5, but the specific attack corpus, success criteria, and environmental assumptions are not disclosed. Rehberger's research is most useful as a prompt for that disclosure. Watch for Anthropic's response to the findings, any update to the Auto Mode documentation on claude.com, and any follow-on work from Embrace The Red that maps the classifier's decision boundary more precisely.