Seventy-two indirect prompt injection scenarios. Ten runs each. 0.00% attack success for Claude Code's auto mode, in a third-party evaluation Anthropic commissioned from Trajectory Labs. Auto mode became the default in mid-August on the strength of numbers like that. On Wednesday Johann Rehberger published an attack chain that works 60 to 80 percent of the time, which Simon Willison flagged the same night.
The gap isn't that the evaluation was run badly. It's that the evaluation scored instructions, and this attack never issues one.
Walk the chain. The user asks Claude to summarize a website. The server answers WebFetch with a 415, and nothing in that response says "use curl" — Claude reasons its way to curl on its own. A 303 redirect hands it a ZIP archive of notebook records. Inside: seven Base85-and-zlib-encoded JSON files, a README, a macOS decoder binary, and a file named struct.py. Claude inspects the binary, decides an unsigned executable from a strange website is not something it should run, and writes its own Python decoder instead. That is the correct call. It is also the exploit. The decoder runs inside the extracted directory, `import base64` pulls in `struct`, and Python finds the attacker's copy first.
An attack does not tell the model what to do. The attack just makes the malicious path the one worth pursuing to solve an objective.Embrace The Red
What auto mode saw was a four-line Python one-liner decoding a documented format in a scratch directory. There is nothing in that command to flag. The refusal to run the binary — the model's one visibly security-conscious decision in the whole run — is what routed it into the attacker's module search path.
The hostile part was never a command. It was a file on disk with a standard-library name.
Then the part that should bother anyone shipping agents. In some runs Claude noticed the compromise afterward, read struct.py, understood what had happened, and moved to kill the process it had spawned.
In a few runs Claude tried to terminate the malware process once it noticed the compromise, but Auto Mode denied the cleanup command.Embrace The Red
The classifier permitted the process that established a C2 callback and denied the command that would have stopped it. Not a bug in the classifier. A property of it. Killing processes and deleting files look dangerous in the abstract; decoding a catalogue does not. A guardrail that scores commands on how destructive they appear will be strictest at exactly the moment you need it to get out of the way.
The honest objection is that these two numbers don't belong in the same sentence. Rehberger says it himself — small sample, one researcher, a chain iterated against a live target until it landed. An 80% success rate on an attack you tuned is not a base rate, and 0.00% across a scripted suite is not a safety proof. Neither number is the finding.
The finding is the shape. An evaluation can only contain attacks somebody thought to write down, and every one of those 72 scenarios has an injected instruction in it somewhere, because that's what the category is named after. Rehberger's chain has no instruction to detect. It has a 415 status code, a decoy binary, and a filename. And the blocked cleanup isn't an injection failure at all — it's the defense doing precisely what it was specified to do, and making the outcome worse.
Rehberger's remediation list runs four lines and none of them mention the model: run the agent in a container or VM, restrict network egress, monitor it, and keep SSH keys and cloud credentials out of its runtime. That is the same advice as before auto mode existed. The default changed. The perimeter didn't.