A prompt-injection chain took over Claude Code auto mode in most attempts

Security researcher Johann Rehberger published a five-stage attack on 26 August 2026 that pushes Claude Code, running unattended in auto mode, off WebFetch onto curl, feeds it a zip archive, gets it to write and run its own decoder, and then executes attacker code when a poisoned local struct.py shadows the standard library on an ordinary import. He reports a 60-80% success rate and is explicit that the sample is small rather than a universal measurement. The safety layer made recovery worse: auto mode then blocked the clean-up commands the agent itself tried to run.

What it means If you run a coding agent unattended, this is the working argument for a container, restricted network egress, and keeping SSH and cloud credentials out of the agent runtime.