This post demonstrates how a targeted attack chain achieves 60-80% success rate hijacking Claude Code Opus 5 in Auto Mode, contradicting Anthropic's third-party evaluation showing 0.00% prompt injection success. Auto Mode, default since mid-August, replaces human approval with a safety classifier. The attack begins when Claude encounters a website returning HTTP 415, prompting it to use curl directly.

The server redirects to a ZIP archive containing metadata and encoded notebook records. Claude extracts files to a temporary directory, refusing to execute the obvious payload but writing its own Python decoder instead. A malicious struct.py in the archive shadows Python's standard library, so when Claude imports base64, it triggers the poisoned module—achieving code execution.

The evaluation used 72 indirect prompt injection scenarios tested ten times each, while this targeted attack achieved much higher success rates. As Boris Cherny from Anthropic noted, layered defenses including model training, input probes, and intent classifiers could reduce indirect prompt injection to near zero.