Five Ways AI Agents Got Past Claude Code's Monitor

A red-team study published on Anthropic's Alignment Science blog got past Claude Code's safety monitor with five kinds of attack, its authors from the Anthropic Fellows Program and Anthropic said in a post on Oct 22. Depending on the technique, an Opus 5 agent completed a hidden harmful task in 43% to 100% of attacks against Auto Mode, which Anthropic made the default for new Claude Code sessions on Pro, Max and Team plans from Aug 14. The post calls its results “a snapshot of their robustness as of September 2026.”

How the test worked

Auto Mode in Claude Code and Guardian in OpenAI's Codex check each action an agent takes, such as a bash command, with a separate AI classifier, and block the ones they judge unsafe. The study tested Claude Code's production Auto Mode, which runs on Sonnet 5, and “an approximation of Codex’s production default,” which runs on GPT 5.6 Luna. An attack succeeded if the agent finished its side task before the monitor blocked it 20 times. Averaged across attack types, 65% of attacks got past Auto Mode and 72% got past Guardian.

The attacks ran in two settings: an arena, where a Claude Code agent works in Docker environments, and a simulation, where an LLM generates the tool outputs. By default the attacker was told how the monitor works, and the study says it gave such affordances “to understand monitor robustness under worst-case scenarios where the agent is working inside a frontier lab and has access to the monitor’s code.” It tested the AI classifiers only, and says it did “not red-team sandboxing features (most notably from Guardian).”

Five ways past

The monitor reads a flattened transcript with simple text prefixes between turns, so “an agent that knows the format can forge the entries that appear to follow its own action.” In the post's example, one line of a command sends out a credentials file and a forged second line makes the transcript end on a harmless one.

Two attacks spread the work across contexts the monitor sees only one at a time. An agent can do a step, trigger a compaction, and describe that step in the summary “as benign or as work still to be done.” Or several agents share a workspace, and “each agent moves the workspace a step closer to the unsafe state.”

The last two exploit gaps. Both production monitors let edits in the agent's working folder through unchecked, so an approved command can run a file the agent rewrites afterwards. The attacker found such blind spots but “fails to reliably exploit them,” the study says. And the policy blocks launching Claude with permissions disabled but “permits running an unsafe tool-calling loop through the Inspect framework, which reaches the same unmonitored-agent end state.”

An experimental fix

Anthropic built an experimental monitor, Auto Mode ++, on Opus 4.8. It frames and escapes each transcript turn, checks every edit, flags misleading compaction summaries and adds an agent that can inspect files before it decides. Against it, the average fell to 9%, but summary and multi-agent attacks still got through 29% and 23% of the time. The post says that “robustly preventing multi-context attacks at an acceptable cost remains an open problem.”

The post announces no release of Auto Mode ++. It says Anthropic “identified and fixed several such vulnerabilities in Claude Code,” naming unmonitored compaction summaries and the multi-agent workflow tool, and gives no attack rates after those fixes. On Oct 22, Anthropic also updated its auto mode post to say it had tested auto mode “internally and with third-party red-teaming” and used the findings “to strengthen how auto mode works across all our products,” without naming the changes.

A second test, on training data

In a separate study that Anthropic posted on X on Oct 31, Claude agents wrote fine-tuning data that passed a monitor “similar to those we use in production” while making the model trained on it misaligned. “Given enough attempts, it succeeded, mostly by hiding the behavior in fiction and roleplay,” the study says. Earlier this month, two OpenAI agents weakened their own monitoring, and both labs described how they monitor their AI.