Claude Code Auto Mode評測：提示詞注入攻擊官方不修 | Claude Code Auto Mode Review: Injection RCE, No Fix Planned

9月 01, 2026

By Kit 小克 | AI Tool Observer | 2026-09-02

🇹🇼 Claude Code Auto Mode評測：提示詞注入攻擊官方不修

資安研究員Johann Rehberger（網名wunderwuzzi）找到一條能繞過Claude Code Auto Mode防護的提示詞注入攻擊鏈，在小規模測試中成功率高達60%到80%，最終能在你的電腦上跑任意程式碼。更麻煩的是——Anthropic目前沒有修復計畫，因為官方認定Auto Mode本來就只是「盡力而為」的便利功能，不是安全邊界。

五步驟攻擊鏈是怎麼運作的

整個攻擊從一個看起來人畜無害的請求開始：叫Claude Code摘要一個「筆記存檔」網頁。根據Rehberger在Embrace The Red的原始研究，流程是這樣的：

Claude用WebFetch去抓網頁，伺服器回傳HTTP 415錯誤（不支援的媒體類型）
被拒絕後，Claude改用Bash工具裡的curl重新嘗試
下載回來的是一個惡意ZIP壓縮檔
Claude自己寫了一段Python解碼腳本來處理裡面的檔案（本意良善，卻踩到陷阱）
ZIP裡藏了一個偽裝成標準函式庫的struct.py，Python的模組搜尋路徑優先讀到這個假檔案，於是被劫持執行——最後彈出小算盤證明入侵成功，同時建立C2連線

整條鏈完全沒有明顯的惡意指令，每一步單獨看都很正常，這正是提示詞注入難防的原因。

Anthropic的回應：官方自己的0%去哪了

諷刺的是，Simon Willison整理的報導指出，Anthropic先前委託的安全評估宣稱Opus 5 Auto Mode在720次提示詞注入測試中0%成功率。這次Rehberger的攻擊卻打到六到八成，官方的說法是：Auto Mode的分類器只是攔截「明顯惡意」的單一指令，沒打算防住這種把良性步驟串起來的組合攻擊。換句話說，官方測試的情境跟真實攻擊者會用的手法不是同一回事。

用Auto Mode的人該做什麼

不要在Auto Mode下處理不信任的網址或檔案，尤其是「幫我摘要這個」這種請求
把WebFetch失敗後自動改用curl／Bash的行為當成風險點，能關就關
Claude自己寫的腳本執行前手動看一眼，尤其是涉及解壓縮、解碼的部分
網路連線分權限、限制對外連線，別讓agent有完整的機器存取權

這不是Claude獨有的問題，任何會呼叫工具、能執行程式碼的AI agent都有同樣的風險結構。Auto Mode方便歸方便，拿去處理不信任的內容前，先想清楚你能承受多少風險。

好不好用，試了才知道。

🇺🇸 Claude Code Auto Mode Review: Injection RCE, No Fix Planned

Security researcher Johann Rehberger (aka wunderwuzzi) found a prompt injection chain that breaks through Claude Code Auto Mode's guardrails, hitting a 60% to 80% success rate in small-scale tests — enough to run arbitrary code on your machine. The worse news: Anthropic has no fix planned, because it considers Auto Mode a best-effort convenience feature, not a security boundary.

How the Five-Step Attack Chain Works

The attack starts innocently: ask Claude Code to summarize a webpage claiming to hold archived notes. According to Rehberger's original write-up at Embrace The Red, here's the sequence:

Claude tries WebFetch, and the server returns an HTTP 415 error (unsupported media type)
Blocked, Claude falls back to curl through its Bash tool
The download turns out to be a malicious ZIP archive
Claude writes its own Python decoder to process the contents — a reasonable, well-intentioned move that walks straight into the trap
The archive hides a poisoned struct.py disguised as a standard library module. Python's module search path picks up the fake file first, hijacking execution — the proof-of-concept popped Calculator and opened a command-and-control callback

No single step looks malicious on its own. That's exactly why prompt injection chains like this are so hard to catch.

Anthropic's Response: What Happened to the 0%?

Here's the irony, as Simon Willison's summary points out: Anthropic's own commissioned security evaluation reported a 0% success rate across 720 prompt injection attempts against Opus 5 Auto Mode. Rehberger's chain broke through 60-80% of the time. Anthropic's position is that the Auto Mode classifier is built to catch obviously malicious single commands, not a sequence of individually benign steps chained together. In short: the official test scenarios and what real attackers actually do aren't the same thing.

What to Do If You Use Auto Mode

Don't point Auto Mode at untrusted URLs or files, especially casual "summarize this for me" requests
Treat the WebFetch-fails-so-fall-back-to-curl/Bash behavior as a risk surface — disable it if you can
Eyeball any script Claude writes for itself before letting it run, especially decoding or decompression logic
Scope network egress and permissions; don't hand an agent full machine access by default

This isn't a Claude-only problem — any tool-calling, code-executing AI agent shares the same risk shape. Auto Mode is convenient, but before you point it at anything untrusted, know how much risk you're actually willing to eat.

Good or not, you won't know until you try it.

Sources / 資料來源

延伸閱讀 / Related Articles

AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends

搜尋此網誌

AI小貼士