This post demonstrates a concrete attack chain against Claude Code's Auto Mode that achieves code execution and C2 callbacks with 60–80% success on small samples. The attack exploits Python module shadowing: a malicious website serves a ZIP with a poisoned `struct.py`, Claude refuses to run the supplied binary decoder but writes its own Python decoder instead, and when that decoder imports base64 from within the archive directory, it loads the attacker's shadowing module instead of the standard library, triggering arbitrary code execution. The author discloses that Anthropic's third-party evaluation found 0% attack success on 72 fixed scenarios, but this chain wasn't in that set—a gap between the benchmark headline and actual resilience. Anthropic treated the report as informative, positioning Auto Mode as a convenience classifier rather than a security boundary. The practical takeaway is straightforward: isolated sandboxing, network egress controls, and monitoring are mandatory, not optional—Auto Mode approval is not evidence of safety.