What jumped out at me was not that Claude Code got tricked. It’s that the whole demo leans on a very ordinary failure mode: the model refuses the obvious bad thing, then confidently improvises a “safe” workaround that lands it in the trap anyway. That feels less like a weird edge case and more like the sort of path a clever attacker would actually prefer.
The part I find most convincing is the module-shadowing trick. If you can get the agent to run its own Python decoder inside attacker-controlled extraction contents, you don’t need to make it “accept malware” in the obvious sense. You just need to let it create the conditions for import-time side effects. That’s a nasty class of bug because the model can be acting cautiously and still be doomed by the runtime environment it chose. I’d absolutely want to test that kind of archive handling in any agent that writes and executes code on my behalf.
I’m less sure about the headline numbers. The post is careful to say the sample size is small, which is good, but people are going to read “60–80%” and mentally turn it into a lab-grade measure. It isn’t. Still, even a small sample is enough to make the underlying point uncomfortable: a best-effort classifier is not a security boundary, and if the agent has shell access plus a writable workspace, you should assume the attacker is playing three moves ahead.
Anthropic’s “informative” response also sounds defensible to me, at least on paper. If Auto Mode is framed as convenience rather than isolation, then blaming the classifier for not blocking a chained exploit is a category error. But I think that answer only holds if users really internalize the boundary. Most people won’t. They’ll see Auto Mode as “safer automation” and then treat it like a sandbox, which it clearly isn’t.
The part that worries me more than the compromise itself is the cleanup denial. If the agent can launch something bad and then be blocked from stopping it once it notices, that’s the sort of failure mode that turns a near-miss into an actual incident. I’d want to know how often the classifier blocks remediation actions that are plainly in the user’s interest. That’s a much more practical question than whether the model can be socially engineered into opening Calculator.
If I were building with Claude Code, I’d read this as another reminder to keep agent workspaces disposable, keep egress tight, and assume any archive or generated script may be adversarial. Auto Mode may still be useful. I just wouldn’t let it near anything I cared about without OS-level isolation.
Reference: Breaking Claude Code Opus 5 Auto Mode · Embrace The Red
