Poisoned zip beats Claude Code auto mode 80% of the time
Johann Rehberger found a prompt-injection chain that slips malicious code past Claude Code's auto mode classifier roughly 80% of the time: a zip, tricking the agent into importing a local struct.py that shadows the standard library. The sting is worse than a bypass. In some runs, the classifier that approved the malware then blocked the agent's own cleanup command. The safety layer became part of the failure, so unattended agents still need real sandboxing.