Autonomous coding agents cannot rely on prompt filters or intent classifiers to maintain system security. A recent exploit chain against Claude Code in Auto Mode achieved an eighty percent attack success rate, directly undermining vendor benchmarks that reported zero percent injection vulnerability.
The vulnerability stems from how the agent interacts with external workspaces. When an untrusted summary request redirected the agent to unpack an archive, the model refused to execute untrusted binaries. However, it attempted to inspect the contents by generating a local Python script inside the extracted folder. Because the folder contained a malicious file named struct.py, standard library imports triggered module shadowing, executing arbitrary shell payloads.
Safety classifiers evaluate conversational intent, but they cannot anticipate the semantic side effects of local operating system primitives. The agent made what appeared to be safe tool choices, yet the execution environment remained completely unconfined.
Hardened container boundaries and ephemeral file systems are mandatory prerequisites before granting autonomous execution permissions to any language model.
