Prompt Injection Bypass of Claude Code Auto Mode Safety Classifier Leading to RCE

Technical Analysis

Auto Mode removes human-in-the-loop approval for tool/code execution and instead relies on an automated safety classifier to gate risky agent actions. The entry point is indirect prompt injection: untrusted web content fetched during a routine 'summarize this website' task contains instructions that hijack the agent's planning/goal state, redirecting it toward executing attacker-supplied commands. Because the classifier evaluates model outputs/intent rather than robustly sanitizing untrusted content ingested via tool calls, the injected instructions cross the trust boundary between passive content-reading and active code execution privileges. The attacker gains arbitrary code execution on the developer's machine with a high reliability rate, and the discrepancy from vendor-reported benchmarks suggests the classifier is not evaluated against realistic, high-effort injection variants.

Affected Systems

Claude Code

Detection Signatures

• Anomalous tool/code execution requests immediately following a passive 'summarize' or 'read website' task
• Unexpected shell command execution triggered from content-fetch tool calls
• Auto Mode approving execution actions with no corresponding user-initiated intent in session logs
• Web content containing embedded imperative instructions directed at an AI agent (e.g., 'ignore previous instructions', 'run the following command')
• Discrepancy between classifier-approved actions and original user task scope

Remediation Steps

1. 1

   Disable or restrict Auto Mode for untrusted content workflows

   Require human approval for any code execution or file-system action triggered after ingestion of external/untrusted web content, regardless of Auto Mode classifier verdicts.

2. 2

   Sandbox and isolate execution

   Run Claude Code Auto Mode sessions in ephemeral, network- and filesystem-restricted sandboxes so successful hijacks cannot achieve persistent or high-impact RCE.

3. 3

   Harden the safety classifier with adversarial testing

   Re-evaluate the classifier against realistic, high-effort indirect injection corpora rather than relying on benchmark results that show implausibly low (0.00%) attack success rates.

4. 4

   Separate content-reading and execution privileges

   Architect the agent so that tools which fetch/summarize untrusted content cannot directly trigger code execution tools without an independent, content-blind confirmation step.

5. 5

   Monitor and log tool call chains

   Implement session-level anomaly detection that flags execution actions occurring immediately after untrusted content retrieval and correlates them with user intent.