Security researcher Johann Rehberger published an attack that defeats the automatic safety checks in Anthropic's Claude Code, which the company recently made the default protection against instructions hidden in content the agent reads. He reports it works about 80% of the time, by getting the agent to unpack an archive and then run code that silently loads a malicious file from it. In some runs the safety layer blocked Claude's own attempt to shut the malware down.
What changed
Anthropic made auto mode the default protection for Claude Code users in August 2026.
What it unlocks
A documented way to test whether an automated coding agent's built-in safety check can be bypassed, and evidence for requiring sandboxes.
- attack succeeded 80% of runs
What you need to act on it
- Claude Code with auto mode
- running agents outside a container or VM to be exposed
Sources