Claude Code Opus 5 Auto Mode Bypass: Pricing Impact
A prompt-injection chain bypassed Claude Code Opus 5 Auto mode in small tests. See the cost impact and the controls teams need now.
By AI Pricing Guru Editorial Team
AI Pricing Guru articles are maintained by the editorial workflow behind the site: daily pricing snapshots, provider source checks, and review passes for model launches, subscription limits, and billing changes.
TL;DR
- A security researcher reports that a targeted indirect prompt-injection chain reached code execution in 3/5, 3/5, and 4/5 runs across three small-sample variants.
- The result does not reproduce Anthropic's earlier fixed benchmark; it shows that Auto mode's classifier is not a sandbox or security boundary.
- Claude plan and API rates did not change. The pricing impact is the added cost of isolation, egress controls, monitoring, and possible incident recovery.
- Do not let an unattended coding agent process untrusted web content on a workstation that exposes credentials, personal files, or unrestricted network access.
Cost comparison from today's pricing data
USD per 1M tokens. Input and output rates are charted separately.
Current model API rates—today's finding changes deployment risk, not token prices
| Model | Provider | Input / 1M | Cached / 1M | Output / 1M |
|---|---|---|---|---|
| Claude Opus 5 | anthropic | $5.00 | $0.5 | $25.00 |
| Claude Sonnet 5 | anthropic | $2.00 | $0.2 | $10.00 |
| Claude Fable 5 | anthropic | $10.00 | $1.00 | $50.00 |
| GPT-5.6 Sol | openai | $4.00 | $0.4 | $20.00 |
Built from pricing.json at publish time.
Updated August 31: A controlled security test has demonstrated code execution through Claude Code Opus 5 in Auto mode. The attack began with an ordinary website-summary request and chained indirect prompt injection, an untrusted archive, and Python module shadowing. The researcher reported success in 60–80% of several five-run variants.
This is a serious deployment warning, not evidence of a price increase or a confirmed attack in the wild. The live table above reads current rates from our maintained dataset. Base Claude subscriptions and model API prices did not change.
What the new Auto mode test found
The Embrace The Red report describes a malicious site that steered Claude Code away from its WebFetch tool and toward a shell download. Claude rejected a supplied native decoder, wrote a short Python replacement, and ran it from inside the attacker-controlled archive. A malicious file then shadowed Python’s standard struct module and triggered a remote payload.
Auto mode evaluated the apparently benign decoder command, not every downstream effect of the imported code. In some runs, Claude recognized the compromise only after execution. The researcher also observed cases where Auto mode allowed the initial chain but blocked Claude’s later attempt to terminate the malicious process.
| Lab variant | Reported result | What it does—and does not show |
|---|---|---|
| Remote payload and command-and-control callback | 3/5 runs | Working code-execution chain in a controlled lab |
| Headless Claude subprocess with reconnaissance | 3/5 runs | A child agent could inherit useful local access |
| Headless Claude subprocess writing outside the workspace | 4/5 runs | Auto mode did not reliably contain filesystem effects |
These are small, iteratively developed samples—not a universal attack-success rate. The author says Anthropic closed the report as Informative and described the behavior as working as designed: Auto mode is a best-effort convenience classifier, while OS isolation and network controls are the real security boundary.
Pricing impact: rates unchanged, risk budget higher
There is no new Claude token rate, subscription discount, or Auto mode surcharge. Anthropic does not charge Pro, Max, or Team users for classifier calls; Enterprise and API/provider sessions still count those calls toward token usage. The official Opus 5 rate remains $5 input, $6.25 for a five-minute cache write, $10 for a one-hour cache write, $0.50 for a cache hit, and $25 output per million tokens. Compare current model rates on our Anthropic pricing page and OpenAI pricing page, or model a metered workload with the token cost calculator.
The changed economics sit outside the rate card:
| Budget line | Before this report | Prudent treatment now |
|---|---|---|
| Model and classifier usage | Existing plan or API treatment | Unchanged |
| Runtime isolation | Easy to treat as optional for trusted repositories | Required for unattended work involving untrusted content |
| Network and secret controls | Often inherited from the developer workstation | Explicit egress rules and short-lived, least-privilege credentials |
| Monitoring and recovery | Commonly omitted from cost-per-task estimates | Include alerts, logs, cleanup, and failed-run review |
A cheaper or more autonomous run is not a saving if it creates a credential-rotation exercise, corrupts a workspace, or consumes engineering time in incident response. Measure cost per accepted, safely contained change, not tokens alone.
Why Anthropic’s 0/720 result can coexist with this bypass
Anthropic’s August Auto mode announcement cited a third-party evaluation covering 72 prompt-injection scenarios, each tested ten times, with no successful attacks against Claude Fable 5, Sonnet 5, or Opus 5 in Auto mode. Today’s report did not rerun those scenarios. It built a different, targeted multi-stage chain.
Both results can therefore be true: Auto mode stopped the published benchmark set, while a new chain bypassed the classifier. The practical lesson is that a zero in a finite benchmark does not prove that every unseen composition of safe-looking steps will be blocked.
Anthropic’s own engineering report also documents a non-zero miss rate for the deployed two-stage classifier. It allowed 17% of 52 real overeager actions and 5.7% of 1,000 synthetic exfiltration attempts in Anthropic’s fixed evaluations. Those figures are not directly comparable with the new targeted chain, but they independently confirm that Auto mode is a probabilistic safety layer rather than an isolation boundary.
Who benefits—and who is exposed
Developers still benefit from fewer approval interruptions and free classifier overhead on eligible paid plans. Auto mode may remain safer than disabling permissions entirely, especially for bounded work in a controlled environment.
Teams most exposed are those letting Claude Code summarize arbitrary websites, unpack external archives, execute generated helpers, or operate with home-directory, SSH-key, cloud-credential, browser-session, or unrestricted network access. Security and platform teams now have a stronger reason to include containment costs when comparing Claude Code with other coding agents.
Anyone evaluating a separately metered fallback can compare the Z.ai coding plan on the same sandboxed tasks.
Affiliate disclosure: AI Pricing Guru may earn a commission from the sponsored link at no extra cost to you. It does not affect this analysis.
What Claude Code teams should do now
- Run unattended agents in a disposable container, VM, or dedicated machine—not on a credential-rich personal workstation.
- Deny network access by default and allow only the destinations required for the task.
- Mount the smallest possible workspace and keep SSH keys, cloud credentials, browser profiles, and personal files outside it.
- Treat downloaded archives and generated scripts as untrusted; inspect them before execution and avoid running Python from attacker-controlled directories.
- Keep logs and an out-of-band kill path. A classifier may block cleanup after allowing an earlier step.
- Re-test the exact Claude Code version, model, tools, and containment policy you deploy. See our best AI for coding guide for broader cost comparisons.
Bottom line
Claude Code Opus 5 Auto mode was bypassed by a credible lab chain, but the evidence is small-sample and does not establish a universal 60–80% compromise rate. It establishes something more actionable: Auto mode approval is not proof that a command’s downstream effects are safe.
Keep Auto mode for convenience if it helps, but put the agent inside a real security boundary. The model price is unchanged; the honest budget now includes containment, monitoring, and recovery.
Sources: Embrace The Red’s August 26 Claude Code Opus 5 Auto mode security report, Anthropic’s official Auto mode announcement, Auto mode engineering report, permission-mode documentation, Opus 5 announcement, and API rate card. Sources checked August 31, 2026.