Hacking Claude Code Auto Mode: 60–80% Success vs. Anthropic's 0.00%

A security researcher hacked Claude Code Opus 5 in auto mode — the mode where the AI runs commands on its own without asking for permission. The attack worked 60–80% of the time: a malicious server tricked the agent with a ZIP archive containing a Python file that replaced a standard library and launched a spyware process with an outbound internet connection. This directly contradicts Anthropic's claim of a 0.00% success rate — but their test simply didn't include this scenario.

Anthropic closed the report with an "informational" label and clarified: auto mode is a convenience feature, not a security guarantee. The gap between marketing benchmarks and real AI agent protection is becoming increasingly apparent — while labs test predetermined scenarios, attackers operate outside them.