Auto-mode in Claude Code and Codex can be tricked into running attacker code, no skills needed: why it is not safe to use

What happened

On July 10, 2026, the AI Now Institute published a proof-of-concept (a working demo, not a real-world attack yet). They planted a tampered copy of a common Python library called 'geopy'. Its documentation hid instructions aimed at the AI. When Claude Code CLI (versions 2.1.116 to 2.1.199) or Codex CLI 0.142.4 reviewed the code in auto-mode, the agent followed those hidden instructions and ran an attacker's program. That opened a live command line with the developer's own access, including secret keys for services like Anthropic and AWS. It worked on Sonnet 4.6, Sonnet 5, Opus 4.8, and GPT-5.5. No add-ons, plugins, or special setup were needed.

What it means for you

If you let an AI agent review or run code you did not write, and you leave it on auto (it acts without asking), a malicious project can borrow your access. The risk lives in the untrusted code, not in the tool alone.

What to do instead

Turn off auto-mode for anything you did not write. Approve each step yourself. Run unfamiliar code in a sandbox or throwaway account, and keep API keys out of that environment. Update your CLI to a patched version once one ships. For skills specifically, AgentPod lists only ones that have been reviewed and tested, which lowers this kind of surprise without removing your need to stay careful.

Sources

• https://www.developer-tech.com/news/developers-face-rce-via-claude-code-auto-mode-exploit/
• https://cybernews.com/security/claude-code-attack-prompt-injection-mozilla/
• https://cybersecuritynews.com/new-claude-code-attack/