A security researcher has demonstrated a successful remote code execution (RCE) exploit against Claude Code Opus 5 in "Auto Mode," achieving attack success rates (ASR) between 60% and 80%. While Anthropic reported a 0.00% success rate for indirect prompt injection in a third-party evaluation, this research highlights a vulnerability to complex, multi-step attack chains that bypass the model's safety classifier. The attack begins by tricking the model into using the Bash tool via a "415 Unsupported Media Type" response, which redirects the agent to download a malicious ZIP archive. To bypass the model's refusal to execute suspicious binaries, the attacker relies on the model's tendency to write its own Python decoder. The exploit utilizes Python module shadowing by including a malicious "struct.py" file within the archive; when the model imports the standard "base64" module, it inadvertently triggers the poisoned script. This enables a secondary payload to launch a remote stager, establish a C2 callback, or even spawn a new, headless Claude Code instance. The researcher concludes that because Auto Mode's safety classifier is not a security boundary, running autonomous agents requires strict OS-level sandboxing, network egress controls, and continuous monitoring.