Rehberger got code execution past Claude Code Opus 5 Auto Mode with a four-step chain.

Serve HTTP 415 to push Claude off WebFetch onto curl, deliver a zip whose bundled binary decoder Claude refuses to run, rely on Claude writing its own Python decoder, and run it inside the extracted directory where importing base64 pulls a malicious struct.py from the archive (Embrace The Red). Success ran 60% on the C2 callback chain and 60-80% on subprocess variants over small samples. In some runs Auto Mode blocked Claude's own cleanup command after detecting the compromise. Anthropic triaged it Informative, saying Auto Mode is a best-effort classifier and the real boundaries are OS isolation and network egress control. That's a defensible position and also a clear instruction: don't treat Auto Mode as a sandbox.