Story · Johann Rehberger
Breaking Claude Code Opus 5 Auto Mode (Johann Rehberger)
blog post · Story page
Johann Rehberger reports a website prompt injection that hijacks Claude Code Opus 5 in Auto Mode and reaches code execution in a small sample.
In plain words
- A webpage summary request made Claude Code's default Auto Mode run attacker-chosen code in a small test.
- Auto Mode lets an automated safety check approve actions instead of asking a person each time.
- The attack succeeded in 60-80% of the small sample, despite an Anthropic-commissioned test reporting 0.00%.
- Claude Code users may face a website-based risk that its existing safety testing did not expose.
Appeared in
- A website summary hijacks Claude Code Auto Mode, and handoffs turn must into maybe
Aug 28, 2026 · lead story
Subscribe
Get the brief in your inbox
Pick daily, weekly, or both. Nothing is gated either way: every issue is on the site and in the feeds.
- Weekdays at 8:45am IST, one lead story and 6 to 9 items.
- Sundays, an argued synthesis rather than a recap.
- One click to leave, and quiet days say so in the subject line.