The prompt was three words and a URL: summarize this website.
No jailbreak phrasing. None of the crude ignore-previous-instructions theatre of the first generation of these attacks. And yet, in a lab writeup published on 26 August and carried through the security press into the first days of September, the developer machine running the coding agent ended up checking in to an attacker-controlled command-and-control server, while the agent carried on with the task it had been given.
The researcher is Johann Rehberger, who publishes as wunderwuzzi at Embrace The Red and has spent years taking apart AI agents. His target was Claude Code running Anthropic Opus 5 in Auto Mode, the semi-autonomous setting that swaps per-action human approval prompts for a safety classifier, and which has been the default starting mode in Claude Code since mid-August. Across three variants of his attack chain, run five times each, he reported success rates between 60% and 80%.
“I would say that these results are representative for a motivated attack, but not comprehensive,” Rehberger wrote.
The shape of the weakness
Nothing in the malicious content told the agent to do anything. The site was dressed as a plausible archive of research records, giving the agent a legitimate-looking reason to dig in. From there the chain narrowed the agent options rather than issuing commands. The constrained, purpose-built retrieval tool the agent normally reaches for was made to fail, so the agent fell back to a general-purpose shell path on its own initiative. Later, handed an obvious piece of attacker-supplied software, the agent did what its training says it should and refused to run it, then wrote its own replacement helper and ran that helper inside attacker-controlled territory. A decades-old quirk in how a common language runtime resolves local files ahead of system ones did the rest.
“Ironically, that safety decision is the exploit path,” Rehberger wrote. The refusal to run the untrusted binary was not a bug in the guardrail. It was the guardrail working, and it was what the attacker was counting on. The model does not trust the tool it was handed, but it trusts the one it wrote itself.
Two further details matter for anyone running agents unattended. In a second variant, the payload did not merely execute code; it launched a fresh headless instance of the coding agent, a whole new agent with its own tool access and context, which then ran reconnaissance and wrote files outside the workspace. And in several runs where the agent noticed the compromise afterwards and tried to kill the malicious process, the Auto Mode classifier denied the cleanup command. The safety layer permitted the process, then blocked the attempt to stop it.
The 0.00% problem
A third-party evaluation commissioned by Anthropic and run by Trajectory Labs tested 72 indirect prompt injection scenarios ten times each, 720 trials in total, and reported a 0.00% attack success rate for Opus 5 in Auto Mode. Boris Cherny of the Claude Code team has said publicly of prompt injection that the company “just cannot demonstrate prompt injection anymore.”
Rehberger does not dispute the benchmark. He disputes what it can bear. His chain was not in the fixed set of 72, so 0.00% on the benchmark and a working remote code execution are both true at once. “That is exactly why a single headline number misleads,” he wrote.
He reported the finding first to Anthropic model bug bounty channel, got no response, then resubmitted through the security reporting channel and heard back quickly. Anthropic closed the report as Informative, telling him the behaviour is working as designed. Rehberger paraphrased the position: “Auto Mode is a convenience feature backed by a best-effort classifier, not a security guarantee.” The real boundary, the company argued, is operating system isolation and network egress control. Rehberger largely agrees. His objection is that it does not sit comfortably next to the marketing. The Register reported that Anthropic did not respond to its request for comment.
Why this matters
The industry has spent two years selling autonomy as the point of coding agents. An agent that stops for approval on every command is a slow pair programmer; the long unattended refactor is the product. Auto Mode exists because Anthropic found users approve roughly 93% of permission prompts anyway, so a classifier clears the obvious ones and escalates after repeated denials.
The trade is that the approval prompt was doing two jobs, and only one was security. It was also an interrupt, a moment where a human saw the trajectory. Take that away and you get what this research illustrates: a sequence of individually defensible decisions, none of which a reasonable classifier would flag, adding up to something nobody approved.
It is the same root class Wiz Research documented in July with GhostApproval, a symlink and interface-misrepresentation flaw across six major coding assistants, where AWS, Google and Cursor shipped fixes, two vendors went quiet, and Anthropic argued the scenario sat outside its threat model. Different primitive, same lesson: consent is meaningless when what is consented to is not what the user sees.
The defences are unglamorous and well known. Containers or VMs, restricted network egress, no home directory, no SSH keys, no cloud credentials in reach, and monitoring that assumes the agent will eventually be wrong. “Auto Mode approval is not evidence that a command is safe,” Rehberger wrote. “Security invariants are not optional.”
What to watch
Whether injection benchmarks evolve past fixed scenario sets toward adversarial, chained evaluation, since the gap between 0.00% and 80% is largely a measurement design gap. Whether vendors ship real sandboxing as a default rather than a documented recommendation. And the agent security track at TechCrunch Disrupt 2026, at Moscone Center on 13 to 15 October, where Okta president of product and technology Ric Smith is expected to argue that application-level permission models are the wrong layer for this problem altogether.
“Ironically, that safety decision is the exploit path.”— Johann Rehberger, Security researcher, Embrace The Red