Claude Code Opus 5: A Workaround and Call for Sandbox

Johann Rehberger, a specialist in prompt injections, describes an attack that bypasses the automatic mode of Claude Code Opus 5 in 80% of trials. Paradoxical situations are observed, where the protection fails to stop the execution of malicious code. The researcher recommends strict isolation of agents. The automatic mode remains a central component and is enabled by default in Anthropic's tool.

Remediation Blocks and a Call for Agent Isolation

Trials show that the automatic mode can prevent the agent from interrupting the execution of malicious code. In some cases, Claude attempted to halt the process after detecting the compromise, but the cleanup command was denied by the automatic mode. The classifier allowed the creation of the undesirable process before blocking the command aimed at stopping it. In light of these risks, Johann Rehberger recommends running agents in isolated environments, such as a container, a virtual machine, or an operating system sandbox. He also advises restricting network outputs, monitoring agent activity, and avoiding exposure of personal files, SSH keys, or cloud credentials to the execution environment.

An Attack Method Described with an 80% Success Rate

Johann Rehberger claims to have developed an attack targeting the automatic mode. He asserts that it succeeds 80% of the time. The technique involves getting the agent to download and then unzip a zip archive, before executing code that imports the base64 module. This import leads to the execution of a local struct.py file extracted from the archive, without the agent recognizing that this file comes from the unzipped source.

Claude Code Opus 5 Relies on an Automatically Enabled Defense

Claude Code Opus 5 heavily relies on an automatic mode designed to counter prompt injections. This mechanism is enabled by default. Ambitious statements have been made regarding its level of effectiveness.