A Working Exploit Against Claude Code's Auto Mode Creates a New AI Agent Security Audit Business: Sell 'Vendor Benchmark vs. Real Attack Chain' Assessments to Teams Running Unattended Coding Agents.

A security researcher just showed that Claude Code's Auto Mode can be tricked into remote code execution — while a vendor benchmark says the attack success rate is 0.00%.

Both of those things are true at the same time.

That gap is the business.

What happened

Anthropic commissioned a third-party evaluation of Auto Mode. The vendor tested "72 indirect prompt injection scenarios ten times each" and reported "0.00% attack success for Opus 5 in Auto Mode."

The researcher then built a targeted chain that wasn't in that scenario set: redirect the agent from its normal web-fetch tool to a raw shell command, serve it an encoded archive, and let it write its own decoder. As the report puts it: "Claude does not trust the supplied binary decoder, but it trusts the one it wrote itself." That single behavior — trusting code it authored over code it was handed — is enough to get a remote payload executing and calling back to the attacker's server.

Run against that chain, the same Auto Mode scored "3/5 (60%)" and "4/5 (80%)" across different variants. "My chain was not in that set. So 0.00% on the benchmark and a working RCE are both true at once."

Why this creates a business opportunity

Every team currently rolling out Claude Code, or any other coding agent, in an unattended or low-approval mode is making a decision based on a vendor's published numbers. Those numbers are real, but they only cover the scenarios that were tested.

That is exactly the gap a security audit sells into:

• most teams have no idea what attack chains exist outside a vendor's benchmark
• most teams have not tested whether their own sandboxing, egress rules, and credential exposure would actually stop a chain like this one
• most teams are treating "the agent asked permission and I said yes" as a safety signal, when the report is explicit that "Auto Mode approval is not evidence that a command is safe"

That is a checklist a non-technical buyer can understand in one sentence: your coding agents were tested against 72 known scenarios, not the one an attacker will actually use.

The offer to sell

1. Auto Mode exposure audit

A fixed-scope engagement: map how a client's coding agents run unattended, what tools they can reach, what they can write to, and what credentials sit near them.

2. Attack chain replication

Run the researcher's published technique (and variants of it) against the client's actual setup, and report a pass/fail matrix by variant, not a single risk score.

3. Sandbox and egress remediation

Implement the concrete fixes: containers or VMs for unattended agents, restricted network egress, activity monitoring, and credential isolation away from agent-reachable paths.

4. Ongoing retainer

Re-run the audit whenever the client adds a new agent mode, tool integration, or model upgrade, since each of those can reopen the gap between "tested" and "actually safe."

Bottom line

A vendor's 0.00% benchmark and a researcher's 80% working exploit are both accurate descriptions of the same product, because they tested different things. Selling the audit that finds out which one applies to a specific client's setup is a real, immediately explainable service — before their unattended agent finds the gap first.

Sources:

https://embracethered.com/blog/posts/2026/breaking-claude-code-opus-5-and-automode/