Anthropic red-teams Auto Mode blocking monitoring
Anthropic Alignment Science blog publishes research red-teaming production block monitoring such as Claude Code's Auto Mode and OpenAI Codex's Guardian. The tests used an Opus 5 red-team agent, and results showed that on average more than 55% of attacks were not blocked. The research points out that the most effective attack methods include agent-generated prompt injection, multi-context attacks across sessions or compressed summaries, and exploitation of a coverage gap where edits within the working directory are not monitored. The team then made improvements such as transcript format escaping and heredoc framing, monitoring all edits, and adding a tool-call investigation agent, launching Auto Mode ++, and the attack success rate dropped by more than 50 percentage points. However, reliably defending against multi-context attacks still directly conflicts with latency costs.
Matched fieldsTitle