安全研究人员发现Claude Code Opus 5 Auto Mode严重漏洞

安全研究人员公开了Claude Code Opus 5 Auto Mode中的一个严重安全漏洞，该漏洞可通过多步攻击链实现高达60-80%的远程代码执行成功率1。这一发现与Anthropic此前基于72个固定场景得出的0.00%攻击成功率形成对比1。

攻击链涉及五个关键步骤：诱导模型放弃使用WebFetch工具转而采用curl、通过ZIP存档重定向、规避二进制文件执行限制、生成不安全代码以及下载最终恶意载荷1。研究人员利用Python struct.py模块遮蔽技术成功触发恶意代码执行1。

Anthropic已关闭了相关报告，坚持认为Auto Mode是便利功能而非安全保证，真正的防护边界应该是操作系统隔离和网络出口控制1。研究人员指出Anthropic关于"已无法演示提示注入"的表述与实际存在的可行远程代码执行漏洞之间存在不一致1。针对这一风险，研究人员建议在容器、虚拟机或操作系统沙箱环境中运行无人值守编码代理，并配合严格的网络出口限制和监控措施1。

Security researchers have identified a serious vulnerability in Claude Code Opus 5 Auto Mode that enables remote code execution with a success rate of 60-80% through a carefully orchestrated multi-step attack chain 1. The exploit works by tricking the model into using curl instead of the WebFetch tool, redirecting to ZIP archives, and leveraging Python module shadowing techniques to execute malicious code 1.

The attack sequence comprises five critical stages: steering away from WebFetch toward curl, redirecting to a ZIP archive, rejecting binary file execution, writing unsafe code, and downloading the final malicious payload 1. Once successful, the attack achieves both remote code execution and command-and-control callbacks 1.

Anthropic has closed the vulnerability report, characterizing Auto Mode as a convenience feature rather than a security guarantee, and stating that true boundaries should be enforced through operating system isolation and network egress controls 1. The researchers point to a messaging inconsistency, noting that Anthropic's previous public statement of a 0.00% attack success rate was based on only 72 fixed scenarios 1. According to the researchers, this earlier assessment does not contradict the existence of the exploitable vulnerability they have demonstrated 1.

The researchers recommend running unattended coding agents within containers, virtual machines, or operating system sandboxes with restricted network egress and active monitoring 1.