Claude Code Auto Mode broken, Nordics must sandbox now

Anthropic’s Claude Code Auto Mode, now the default, is broken by prompt injection attacks 80% of the time, the network must decide tonight whether to enforce sandboxes or abandon the agent.

NEW FACTS Anthropic made Auto Mode the default in Claude Code Opus 5 on August 14. They claimed it blocked 89% of harmful actions in evals. Johann Rehberger, a credible prompt injection researcher, broke it 80% of the time. The attack tricks Claude into downloading a zip archive, uncompressing it, and executing code that imports a malicious `struct.py` file. Auto Mode itself blocks cleanup commands, turning the safety mechanism into part of the failure. WHAT CHANGES Auto Mode is not a safety layer. It is a liability. The evals Anthropic published were synthetic; real attacks succeed at scale. The network’s builders who adopted Claude Code in the last two weeks are exposed. Those who built workflows on Auto Mode’s promises must now rebuild or isolate. WHAT THE NETWORK MUST DO Run unattended coding agents in a container, VM, or OS sandbox. Restrict network egress. Monitor agents. Never expose home directories, SSH keys, or cloud credentials to the agent runtime. These are not new rules; they are now non-negotiable. WHAT THE NETWORK MUST DECIDE The poll tonight asks whether to enforce sandboxes for all Nordic-built agents, or let each team decide. If the network does not enforce, it accepts the risk of credential leaks, data exfiltration, and infrastructure compromise. If it enforces, it must build or adopt a sandbox standard within 30 days. FORECAST Within six months, at least one Nordic builder will suffer a credential leak or data exfiltration from an unsandboxed agent. The network will then enforce sandboxes retroactively, at higher cost. POLL

researched · 2 sources

28 Augreaches everyone