This is in case you didn't realize yet that all these graphs they pitch are bulshytt

optimism

In this post, we explore how a simple website summary request hijacks 

 and achieves code execution with 60-80% attack success rate using a small sample size.

This is interesting because a third-party evaluation commissioned by Anthropic showed a 

 prompt injection attack success rate for Opus 5 in Auto Mode.

Auto Mode replaces human approval prompts with a safety classifier. Since mid-August it is the default starting mode for Claude Code.

To make my key point right away: If you care about what’s happening and are worried about misalignment, hallucinations and prompt injection, then 

Auto Mode IS NOT a substitute for running your agent in an isolated environment and monitoring what it is up to

 that layered defenses could reduce indirect prompt injection on unseen attacks to approximately zero. The layers were model training, input probes and an intent classifier. They hired a vendor (Trajectory Labs) to test 72 indirect prompt injection scenarios ten times each. The evaluation seems to not have a published benchmark name, and the 

0.00% attack success for Opus 5 in Auto Mode

I wanted to see how that result holds up against a targeted attack chain.

> In this post, we explore how a simple website summary request hijacks `Claude Code Opus 5` in `Auto Mode` and achieves code execution with 60-80% attack success rate using a small sample size.
>
> This is interesting because a third-party evaluation commissioned by Anthropic showed a `0.00%` prompt injection attack success rate for Opus 5 in Auto Mode.
>
> ## Auto Mode Is Now the Default in Claude Code
>
> Auto Mode replaces human approval prompts with a safety classifier. Since mid-August it is the default starting mode for Claude Code.
>
> To make my key point right away: If you care about what’s happening and are worried about misalignment, hallucinations and prompt injection, then **Auto Mode IS NOT a substitute for running your agent in an isolated environment and monitoring what it is up to**.
>
> Boris Cherny from Anthropic recently [posted](https://x.com/bcherny/status/2085860677990883454) that layered defenses could reduce indirect prompt injection on unseen attacks to approximately zero. The layers were model training, input probes and an intent classifier. They hired a vendor (Trajectory Labs) to test 72 indirect prompt injection scenarios ten times each. The evaluation seems to not have a published benchmark name, and the [shared chart](https://x.com/bcherny/status/2085860677990883454) shows **0.00% attack success for Opus 5 in Auto Mode**.
>
> I wanted to see how that result holds up against a targeted attack chain.
>
> [**...read more at embracethered.com**](https://embracethered.com/blog/posts/2026/breaking-claude-code-opus-5-and-automode/)