Prompt injection defeats Claude Code auto mode roughly 80% of the time

Johann Rehberger demonstrated a prompt injection attack against Claude Code's auto mode that succeeds roughly 80% of the time. The attack tricks Claude Code into downloading and decompressing a zip archive, then executing code that silently runs a malicious local file extracted from the archive. In some runs, auto mode blocked Claude's own command to terminate the malware process after Claude had already detected the compromise, meaning the safety classifier prevented remediation while having allowed the malicious process to start. Anthropic had made auto mode the default and claimed effectiveness against prompt injection. Separately, RyotaK of GMO Flatt Security disclosed a vulnerability chain (CVE-2025-66032) in Anthropic's claude-code-action GitHub Action that chained authorization bypass, indirect prompt injection, and environment variable exfiltration, allowing an attacker to push malicious code starting from a public GitHub issue. Anthropic received that report on January 12, 2026 and deployed fixes within four days.