Misbehavior2 sourcesFirst seen
Claude Code's Auto Mode Waved the Malware In, Then Blocked the Cleanup
Ourtake
The classifier approved the malware and then refused to let anyone kill it. Auto Mode is a convenience feature, not a sandbox.
What happened
A security researcher showed that a booby-trapped website archive could redirect Claude Code running Claude Opus 5 in Auto Mode into executing a malicious Python module, reaching code execution in small lab samples with success rates up to 80%. In some runs Auto Mode's classifier allowed the malicious process to start but blocked the command meant to stop it. Anthropic closed the report as informative, saying the behavior works as designed.