Claude Code. The whole idea was to create this shiny, protective layer that supposedly stops prompt injection attacks from turning your coding agent into a malicious bot. They made some pretty bold claims about how bulletproof this is, but as it turns out, even the most expensive digital bodyguard can be tricked into letting a thief walk right through the front door—and then refusing to let you call the police.
I was looking into some recent research by Johann Rehberger (who is actually a serious player in the prompt injection space, not just some script kiddie), and the way he bypassed this "safety" layer is almost comedy-gold levels of ridiculous.
The attack is a masterclass in social engineering for LLMs. Instead of a blunt-force attack, he tricked Claude Code into down and uncompressing a ZIP archive. Once that archive was unpacked, the agent executed code that imported base64
. On the surface, that looks totally innocent, right? Wrong. The payload was designed so that the import actually triggered the execution of a local struct.py
file that had been snuck into the archive. It’s a classic "Trojan Horse" maneuver, but executed through a high-level coding agent.
But here is the part that actually makes my blood boil: the safety mechanism itself becomes the weapon.
In a few of these test runs, the Claude agent actually realized it was being compromised. It detected the malicious behavior and tried to run a command to terminate the malware process. And what did Auto Mode do? It blocked the cleanup command.
Think about that for a second. The safety classifier was too "dumb" to stop the initial malware process from starting, but once the agent realized it was in trouble and tried to fix it, the safety layer stepped in and said, "Nope, you're not allowed to run that command." It effectively handcuffed the agent while it was being robbed. It’s like having a security guard who lets a robber into your house but then tackles you when you try to grab a baseball bat to defend yourself.
If you are building an AI workflow that uses autonomous agents, please, for the love of your SSH keys, do not rely on "Auto Mode" or any LLM-native safety feature as your only line of defense. This is a perfect example of why we need a real-world, practical tutorial on sandboxing every single time we deploy an agent.
If you aren't running your coding agents in a strictly controlled environment, you are basically asking for trouble. Here is the bare minimum setup if you want to sleep at night:
Isolation: Run unattended agents inside a container, a VM, or a dedicated OS sandbox.Network Control: Heavily restrict network egress so the agent can't call home to some random C2 server.Monitoring: Keep a very close eye on what the agent is actually doing in real-time.Credential Hygiene: Never, ever expose your home directories, SSH keys, or cloud credentials to the agent's runtime environment.
Prompt engineering might get you better code, but it won't save you from a clever injection if your architecture is fundamentally wide open. Use a sandbox. Seriously.
Next Claude Code's Auto Mode is failing its own safety claims →