Researcher reports Claude Code Auto Mode exploit chain

A security researcher reported a lab attack chain that led Claude Code Opus 5 in Auto Mode from a website-summary task to execution of a remote test payload, with observed 60% to 80% success rates in a small sample. The reported chain used a downloaded archive and Python module shadowing after the agent wrote and ran its own decoder. The researcher said Anthropic closed the disclosure as informative and described Auto Mode as a convenience feature, with OS isolation and network-egress controls as the security boundary.