Prompt injection is when content an agent reads (web pages, source files, tool results) carries hidden instructions meant to pull it away from the user’s original request.1 Any agent that reads text it did not write is exposed.
Defenses described in the sources
| Setting | Defense |
|---|---|
| Claude Code Auto Mode | A server-side probe scans tool results and flags suspicious instructions, and the classifier checks that Claude’s next action still matches the user’s intent; an attack has to pass both.1 |
| Claude Code GitHub Actions | Treat issue text, comments, and changed repository content as untrusted input; grant only the needed permissions and tools; require human review and branch protection before merging.2 |
Anthropic reports that prompt-injection attack success fell to zero in its evaluations with both the probe and Auto Mode on. The note stresses this is Anthropic’s internal evaluation, not a guarantee for every environment.1
Related
- Least-privilege tool access: limits what a successful injection can do.
- Source: How Claude Code Auto Mode Works
- Source: Claude Code GitHub Actions