Claude Code自动模式被曝80%成功率绕过，安全机制反成漏洞
Breaking Claude Code Opus 5 Auto Mode
做 AI Agent 安全或依赖 Claude Code 自动模式的同学必看，这个攻击思路和沙箱防护清单可以直接拿来加固自己的代理环境。
Breaking Claude Code Opus 5 Auto Mode
破解Claude Code Opus 5自动模式
Anthropic are putting a great deal of faith in Claude Code's auto mode for protecting their coding agent users against prompt injection attacks. They recently made that the default and have made bold claims about its effectiveness.
Anthropic对Claude Code的自动模式寄予厚望，认为它能保护其编码代理用户免受提示注入攻击。他们最近将此设为默认模式，并对其有效性做出了大胆声明。
Johann Rehberger is one of the most credible prompt injection researchers active today. He found an attack against auto mode which he claims works 80% of the time, by tricking Claude Code into downloading and uncompressing a zip archive, then executing code that imports base64 without noticing that this will import and execute a local struct.py file extracted from the archive.
Johann Rehberger是当今最可信的提示注入研究者之一。他发现了一种针对自动模式的攻击，声称成功率高达80%，通过诱骗Claude Code下载并解压一个zip压缩包，然后执行导入base64的代码，而未注意到这会导入并执行从压缩包中提取的本地struct.py文件。
In a few cases auto mode directly prevented the agent from preventing harmful code from continuing to execute!
在某些情况下，自动模式直接阻止了代理防止有害代码继续执行！
In a few runs Claude tried to terminate the malware process once it noticed the compromise, but Auto Mode denied the cleanup command.
在几次运行中，Claude一旦发现被入侵，便尝试终止恶意软件进程，但自动模式拒绝了清理命令。
Claude detects the compromise, but Auto Mode blocks its cleanup command
Claude检测到入侵，但自动模式阻止了其清理命令
The safety mechanism itself can become part of the failure. The classifier allowed the creation of the malware process, but then it blocked the command intended to stop it!
安全机制本身可能成为失败的一部分。分类器允许了恶意软件进程的创建，但随后却阻止了旨在停止它的命令！
I agree with Johann's conclusion here: the only safe way to run agents if there's any risk of attracting the attention of an adversarial attack is with a sandbox:
我同意Johann的结论：如果存在任何吸引对抗性攻击注意的风险，运行代理的唯一安全方式是使用沙箱：
- Run unattended coding agents in a container, VM or OS sandbox.
- Restrict network egress.
- Monitor your agents.
- Do not expose home directories, SSH keys, cloud credentials,… to the agent runtime. [...]
- 在容器、虚拟机或操作系统沙箱中运行无人值守的编码代理。
- 限制网络出口。
- 监控你的代理。
- 不要将主目录、SSH密钥、云凭证等暴露给代理运行时。[...]
Tags: sandboxing, security, ai, prompt-injection, generative-ai, llms, anthropic, claude, johann-rehberger, claude-code
标签：沙箱化、安全、人工智能、提示注入、生成式AI、大型语言模型、Anthropic、Claude、Johann Rehberger、Claude Code
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力