A coding agent can refuse an untrusted program and still execute untrusted code through a replacement it writes itself. Johann Rehberger’s August 26 laboratory demonstration started with a website-summary task in Claude Code Opus 5 Auto Mode. A generated Python decoder ran in an extracted archive containing a module that shadowed a standard-library import. The researcher reported successes in three or four of five runs per variant; those small samples do not establish a universal compromise rate. [1]
For developers, the practical check is the environment in which the tool executes: accessible files, inherited credentials, network destinations and child processes. The fact that an approval classifier allowed a step is not a record of what that step could reach.
Inspect the transition from reading to running
A request to summarize material starts as a reading task. If completing it turns into extracting an archive and running a decoder, the task now includes execution. Pause that transition when the source is untrusted and choose an environment appropriate to it.
Code written during the session still uses its runtime’s import paths and surrounding files. Reviewing only the short script can miss a dependency supplied by the same untrusted archive. A familiar module name is not enough to establish which implementation will be loaded.
| What you observe | What it establishes |
|---|---|
| The agent refused a supplied binary | That particular action was rejected. Inspect any alternative execution path separately. |
| The agent wrote its own decoder | You have a new script to review, including its working directory, imports and available data. |
| The task runs in a temporary folder | You know a location. A directory name alone does not enforce filesystem or network isolation. |
| The conversation ended | The chat stopped. Verify independently whether processes or scheduled work remain. |
Check the actual sandbox settings
Claude Code’s documentation describes the Bash sandbox as OS-enforced filesystem and network restrictions that also apply to child processes. The /sandbox panel shows its mode, overrides and resolved configuration. Sandboxed command auto-allow and the Auto Mode permission classifier are different controls. [2]
Open that panel in the environment you use, rather than assuming a saved preference applies everywhere. Review what is writable, which sensitive files are readable and which network destinations are allowed. Also check tools outside the Bash sandbox’s scope; a label on one tool does not describe every integration in the session.
The documentation describes an unsandboxed retry path and command exclusions. Those settings affect the boundary actually enforced. [2] If your task requires strict isolation, verify with your administrator that the effective policy prevents unintended fallback and that excluded tools receive an appropriate separate boundary.
For an unfamiliar archive, a disposable environment with only the required inputs is easier to reason about than a normal workstation carrying production credentials. A container or VM still needs its mounts, environment variables and network access reviewed. Its name alone does not tell you what was exposed.
Do not rely on the agent to certify its own cleanup
Rehberger reports that a child process could outlive the conversation and that some test runs recognized the problem only after execution. He also reports that Anthropic classified the submission as Informative, treating the classifier as best effort. These are the researcher’s observations and account of the response. [1]
If an untrusted task unexpectedly executed code, retain the tool history, archive provenance and process details. Stop the environment through controls you manage and involve the appropriate responder. Do not keep running the suspicious input to see whether the agent produces a more reassuring explanation.
Where credentials may have been reachable, identify the actual access and rotate affected values through their issuing services from a trusted environment. Review provider activity as well as local files. Closing the terminal does not invalidate a copied credential.
Keep the finding in proportion
This publication describes a controlled demonstration, not a disclosed campaign against ordinary users. A five-run test can establish that a path worked under those conditions; it cannot tell every reader their personal odds of compromise.
The useful engineering outcome is a recorded boundary: which inputs the agent may execute, what those processes can access and how you stop them. Apply that review to the whole workflow, including the helpful-looking workaround after a refusal.
References
- Johann Rehberger, Embrace The Red. Claude Code Opus 5 Auto Mode laboratory demonstration. August 26, 2026.
- Claude Code Docs. Bash sandbox configuration, scope and limitations. Accessed September 7, 2026.
