Claude Code Opus 5 Auto Mode yields 60-80% prompt injection success via ZIP struct shadowing

The attack begins with a 415 response that steers the model from WebFetch to curl, followed by a 303 redirect to a ZIP containing Base85-encoded records and a decoder-darwin binary. Claude refuses the binary yet writes and executes its own Python decoder inside the extracted directory. A malicious struct.py placed there intercepts the subsequent import of base64, granting code execution.

Anthropic-commissioned Trajectory Labs testing reported 0.00% success across 72 scenarios run ten times each. The current targeted chain, using only a small sample, produced 60-80% success. The evaluation omitted directory-context module shadowing and did not test transitions from summary tasks to shell tool use under Auto Mode defaults introduced mid-August.

Auto Mode replaces explicit approval with an intent classifier yet leaves the execution environment shared with attacker-controlled files. Layered defenses of training, probes, and classifiers therefore remain insufficient against chains that convert legitimate tool calls into namespace attacks. Operators must continue isolating agents and logging every file write and import.

Similar import-shadowing vectors exist in other agent frameworks that grant write access inside task directories. Future evaluations should include explicit tests for stdlib poisoning after tool-driven extraction.