A Claude Code test exposes Auto Mode limits
Reviewed by Helen Jones
Security researcher Johann Rehberger reports that a crafted web-summary task led Claude Code Opus 5 Auto Mode to execute attacker-controlled local code in his test setup. The post describes a ZIP-file chain and says Auto Mode, which replaces routine approval prompts with a classifier, became the default starting mode in mid-August; the reported attack rate comes from a small sample and has not been independently confirmed here.
Automatic approval can reduce friction, but it does not make a coding agent a safe place to open untrusted web content or archives. The reported chain matters because it uses an ordinary-looking research task and a local-file side effect, not a request that obviously looks dangerous to a human reviewer. The practical lesson holds even if a specific demonstration is later revised: the control that limits damage is the runtime boundary. An agent that can reach credentials, home directories or production networks has more at stake than an agent running in an isolated environment with restricted network access and useful logs.
Analysis
For any unattended coding or research agent, list its writable folders, reachable services, credentials and outbound network paths. Move one real job into a disposable sandbox and verify that a compromised run cannot reach personal or production secrets.
Source note
Pulse published by Collab365 Spaces, reviewed by Helen Jones on . Cite as "A Claude Code test exposes Auto Mode limits", Collab365 Spaces.