Researcher Johann Rehberger bypassed Anthropic's Claude Code auto mode with an 80% success rate. The attack tricks the agent into downloading a zip archive and executing a local Python file via a base64 import. This vulnerability exposes a critical flaw in the agent's prompt injection defenses.