Anthropic's Claude Auto Mode found vulnerable to prompt injection

Anthropic has made auto mode the default and made bold claims about its effectiveness in protecting coding agents against prompt injection attacks. However, a credible researcher found a flaw that undermines that confidence. The attack succeeds 80% of the time, and in some runs, auto mode blocked the agent's own attempts to terminate the malware. This shows that a safety feature can become part of the failure — the classifier allowed the malware process to be created, but blocked the command to stop it.

The article sides with the researcher's conclusion: the only safe way to run agents when facing adversarial attacks is to sandbox them. That means using containers, VMs, or OS sandboxes, restricting network egress, monitoring agents, and not exposing sensitive files like SSH keys or cloud credentials. This is a practical warning for businesses relying on AI agents for automated coding tasks, as it highlights the need for strong security measures at the infrastructure level.