No — Claude Code’s Auto Mode is not the reliable prompt-injection shield Anthropic markets it as. Security researcher Johann Rehberger found a working bypass using what he calls a confused-environment attack, not classic injection. We reviewed his mitigation checklist against our own AI development platform’s architecture, and found a live gap of our own.
What Rehberger’s Exploit Actually Does to Auto Mode
Rehberger’s attack against Claude Code Opus 5’s Auto Mode isn’t the prompt injection Auto Mode was built to stop. It’s what the research calls a confused-environment attack: a trojan archive plants a file named struct.py inside the project’s working directory, then waits. Python resolves imports by checking the current working directory before the standard library, so the moment any later, unrelated line of code triggers an import that depends on struct — Rehberger’s demonstration uses nothing more exotic than import base64 — the interpreter loads the planted file instead of the real module. No prompt ever asks the model to do anything malicious. The model just runs ordinary-looking code in a directory that’s already been sabotaged. Rehberger, whose earlier prompt-injection research is some of the most cited in the field, reports the technique succeeding in roughly 80% of his own test runs against Auto Mode — a figure from his testing, not a vendor benchmark.
project/
├── struct.py # planted by the trojan archive; shadows the stdlib module
└── main.py # later: `import base64` resolves struct.py first
Everything downstream of that import runs inside a compromised interpreter, with no injected instruction for anyone — human or model — to flag.
The Guardrail That Blocked Its Own Cleanup
The detail that made us take this seriously wasn’t the import trick — plenty of supply-chain attacks work this way. It’s what happened after Claude noticed. According to the reporting, Claude Code detected that something was wrong with its own environment and tried to fix it. Auto Mode’s own safety layer — the layer designed to stop a compromised agent from doing damage — blocked the cleanup command the model wanted to run. The guardrail didn’t fail to notice the attack. It noticed, then got in the way of the fix. That’s a different failure mode than “the model didn’t catch it,” and it’s the one that should worry anyone leaning on Auto Mode as a complete safety net: a control built to stop bad actions can’t always tell a remediation attempt from a continuation of the compromise, and erring toward caution in that exact moment leaves the compromised state in place.
Our contrarian take: this doesn’t mean Auto Mode is worthless, or that turning it off is the safer move. A guardrail that’s watching closely enough to catch the compromise, even if it’s tuned wrong at the last step, is still doing more than no guardrail at all. The fix is tuning the control, not discarding it.
Why We Rated This “Adopt” — And What We’re Not Doing
Our platform runs a Devil’s-Advocate review before we act on any external security research — a deliberate step where we argue against adopting a trend before we agree to change anything. This one passed as “adopt,” but not wholesale. Rehberger’s writeup converges on three mitigations for coding agents:
- Run the agent inside containers, VMs, or OS-level sandboxes.
- Restrict its outbound network access.
- Keep sensitive data — home directories, SSH keys, cloud credentials — out of the agent’s runtime entirely.
Our pipeline already covers the first one: every task runs in Docker, inside its own per-task worktree, which is most of what a from-scratch sandbox would buy us. Bolting a second, parallel sandboxing layer on top would mostly duplicate infrastructure we already operate, so we didn’t add one. The third mitigation is where the review stopped being theoretical.
Walking that checklist against our own pipeline, we found a live version of exactly the exposure Rehberger warns about — just not through his attack path. A step in our pipeline that renders model-authored content for preview runs as a process that inherits the full parent environment: every credential our web service holds, from the AI provider key to the source-control token, the database connection string, and the notification bot’s token, all sitting in reach of code we don’t fully control. We’ve opened an internal fix to strip that inheritance down to the handful of variables the process actually needs.
How Do You Isolate an AI Coding Agent From Your Secrets?
This is the general version of the problem, stripped of any single vendor’s incident. Any process that lets an AI agent evaluate or execute content it didn’t fully vet should not inherit a blanket copy of its parent’s environment. The fix isn’t exotic. Pass an explicit allowlist of environment variables into the child process instead of the whole dictionary. Run agent-facing code paths under a service account with no filesystem access to home directories, SSH keys, or cloud credential files. Restrict outbound network access for any process that executes model-authored content, so a successful compromise can’t phone out with what it finds. None of this requires guessing whether a given input might be malicious. It requires assuming that eventually, one will be, and designing so that being right about that assumption doesn’t cost you your credentials.
What We Didn’t Resolve
One question from this review is still open, and we’re not going to pretend otherwise. Our pipeline checks out generated project repositories into per-task worktrees, and a self-hosted fleet of CI runners executes each project’s own test suite on infrastructure that also hosts production containers. Whether any of our own code ever runs with a customer project’s worktree sitting ahead of the standard library on its import path — the exact mechanism Rehberger’s exploit depends on — is a separate question this review raised but didn’t close. Asserting we’re exposed would be dishonest; asserting we’re clean would be worse, because we haven’t checked yet. It’s next on the list, and it stays open until someone has actually traced the import order rather than assumed it.
One more thing worth recording, because it’s the kind of detail that makes a research verdict feel less abstract: during the same scan that produced this review, our own research pipeline flagged an incoming instruction shaped like a prompt injection, aimed at the scanner itself. Nothing came of it beyond a log entry — but it landed the same week as this exploit and the same week we found the environment-inheritance issue above. Three unrelated signals pointing at the same missing boundary is enough to move something from “someday” to “now.”
FAQ
Is Claude Code’s Auto Mode safe against prompt injection?
Not completely. Security researcher Johann Rehberger demonstrated a working bypass using a technique he calls a confused-environment attack rather than classic prompt injection, succeeding in roughly 80% of his own test runs against Auto Mode. Auto Mode raises the bar, but it isn’t the complete shield its rollout implied.
What is a confused-environment attack?
It’s an attack that never injects an instruction into the model. Instead, it plants a malicious file — in Rehberger’s case, a fake struct.py — inside the working directory, where Python’s import resolution picks it up ahead of the real standard-library module the moment unrelated code imports something that depends on it.
Why did Claude Code’s own safety feature make the attack worse?
According to the reporting, Claude detected the compromised environment and tried to run a cleanup command. Auto Mode’s guardrail blocked that command, treating the remediation attempt with the same caution it applies to any risky action — leaving the compromised state in place instead of letting the model fix it.
How do I isolate an AI coding agent’s secrets from its runtime?
Pass an explicit allowlist of environment variables into any process that executes agent- or model-authored content, rather than the full parent environment. Run that code under a restricted service account, and cut outbound network access wherever the process doesn’t need it. The goal is limiting damage after a compromise, not just preventing one.
Should every AI coding platform run agents in a sandbox?
Container or VM isolation per task is a strong default, and it’s most of what a dedicated agent sandbox buys you. If a platform already runs tasks in per-task containers or worktrees, adding a second, parallel sandboxing layer on top mostly duplicates infrastructure — the bigger gap is usually what secrets that container can still see.
Get a free recommendation from a senior engineer.