Breaking Claude Code Opus 5 Auto Mode

A recent exploration revealed that Claude Code Opus 5 in Auto Mode can be hijacked with a simple website summary request, achieving code execution with a 60-80% success rate. This method, which uses python3 -I for isolated execution, allows for subprocess reconnaissance and even writing to files outside the workspace. This is described as a "confused environment attack" rather than a classic prompt injection, as the LLM doesn't follow malicious instructions but is exploited due to its environment.