Claude Code's Auto Mode Has a Prompt Injection Problem

Claude Code Auto Mode Cracked by Prompt Injection

If you have engineering teams running Claude Code in auto mode — and after Anthropic made it the default, most do — this one needs action before next sprint.

Simon Willison's writeup of Johann Rehberger's research documents an attack against Opus 5 auto mode that Rehberger claims succeeds the majority of the time. The vector: trick Claude Code into downloading and decompressing a zip archive, then execute code that imports base64 — which the agent doesn't flag as suspicious — to stage and run an arbitrary payload. Anthropic has made bold claims about auto mode's prompt injection resistance. Rehberger is not a junior researcher testing party tricks; he is one of the most cited prompt injection specialists working today. This result matters.

What to do: Pull your Claude Code rollout policy this week and verify two things. First, is auto mode enabled globally or only for specific trust contexts? Auto mode should not be the default for agents that have network egress and can decompress remote archives. Second, review which file and Bash tool permissions are scoped per project. Auto mode is a classifier, not a sandbox — it does not substitute for least-privilege tool grants.

--restricted Mode Ships in v2.1.248

Fortunately, Anthropic shipped a direct answer to the above in the same release window.

Claude Code v2.1.248 adds --restricted (or CLAUDE_CODE_RESTRICTED=1), a new flag that removes the built-in Bash, code-execution, and WebFetch tools unless you explicitly re-allow them with --tools. File operations are confined to the working directory. bypassPermissions is refused. User, project, and local settings files are ignored entirely.

This is the enterprise deployment primitive we've been waiting for. For any Claude Code runner that processes external content — ticket bodies, pull request descriptions, ingested documents — restricted mode should be the baseline, not an opt-in hardening step. The same release also adds experimental.cacheTtl to agent frontmatter ("5m" or "1h"), which matters for multi-agent pipelines burning prompt-cache budget on long-context subagents.

What to do: Update your self-hosted runner launch configs to pass --restricted for any agent that touches external-origin data. If you're using the Claude apps gateway, pair this with the new rate_limits.spend_limit status field from v2.1.251 — you can now surface per-session spend against a gateway budget cap before a runaway agent hits your monthly ceiling.

Spend Visibility and Cache Telemetry in v2.1.251

Claude Code v2.1.251 also ships the spend limit bar in /usage and — more useful for architects — a per-session prompt-cache breakdown in /cost: hit ratio, misses, tokens re-cached, warm/cold state. For a 12,000-seat engineering org running shared subagent pipelines, the difference between a warm and cold cache hit on a large system prompt is real money at scale.

The PreModelSwitch and PostModelSwitch hook events also shipped here. If you've built orchestration that assumes a single model per session, auto mode's dynamic switching has been an invisible variable. You can now block, confirm, or annotate those switches programmatically. For clients with data-residency requirements on specific Claude endpoints, this is the hook to gate on.

What to do: Wire PreModelSwitch hooks into any session where model identity has compliance implications. Use the new cache cost line to instrument your highest-volume pipelines before you negotiate your next API commitment tier.

Anthropic SDK v1.1.0 Adds Organization API Endpoints

Both the Python SDK v1.1.0 and TypeScript SDK v0.121.0 shipped the same day with Organization API endpoint support. This is the programmatic surface for managing API keys, members, and usage at the org level — previously only accessible through the console.

For clients who want to bring Claude API governance into their existing IaC or IAM automation pipelines, this is the unlock. Pair it with the pause_turn tool-runner bug fix (also in both SDKs) if you're running human-in-the-loop confirmation flows — that fix prevents the tool runner from halting on a paused turn.

What to do: If you're managing multiple Claude API keys across teams manually today, test the Organization endpoints now. The GA window for hardening org-level automation before Q4 headcount growth is this quarter.

M365 Copilot People Data Quality Report

On the Microsoft side, Microsoft 365 Roadmap item 568937 adds a Data Quality Report for profile data in the M365 admin center. It surfaces completeness and quality of people attributes that feed the People Card, Org Explorer, and — directly relevant — Microsoft 365 Copilot's people-grounded responses.

This matters because Copilot's org-graph reasoning is only as good as the underlying profile completeness. Clients who've rolled out Copilot and noticed degraded "who knows about X" queries often have attribute gaps they can't currently see. This report makes that visible to AI Administrators for the first time.

What to do: Assign the AI Administrator role to whoever owns your Copilot rollout health, and run a baseline report when this ships. Attribute gaps found now are fixable before your next Copilot business review.

---

Watch next week for any Anthropic response to the Rehberger disclosure — specifically whether a v2.1.25x patch tightens the archive-decompression trust boundary in auto mode's classifier rules.