Safety classifiers versus security boundaries

Summarizing a webpage was enough to run attacker code in Claude Code's Auto Mode

Johann Rehberger's chain landed 60% to 80% of the time in the mode Claude Code has run by default since mid-August. Anthropic closed the report as informative and pointed customers at OS-level isolation.