Claude Code Auto Mode: 0% Injection "Proof" Beaten by an 80% Attack Chain
Embrace The Red broke Claude Code's default Auto Mode, which replaced human approval prompts with a safety classifier, hitting 60-80% attack success on a small sample. The chain nudges the agent off WebFetch onto curl, then into a ZIP whose poisoned struct.py shadows Python's standard library. The result undercuts Anthropic's vendor-commissioned evaluation showing 0.00% success, and it is a reminder that a classifier is no substitute for an isolated sandbox.