Red-Teaming Auto Mode: Improving Blocking Classifiers Against Malign Coding Agents
Alex Remedios, Simon Storf, Fabien Roger and John Hughes at Anthropic red-team the production blocking monitors that review each coding-agent action (Auto Mode in Claude Code, Guardian in Codex) under the assumption that the monitored agent is itself persistently misaligned.
Ask this paper
Injection against the monitor works in 79 percent of trials. Given high-level attack strategies, the adversarial agent gets arbitrary bash commands past both Auto Mode and Guardian at that rate.
Several distinct mechanisms succeed. Agent-generated prompt injection aimed at the monitor, multi-agent attacks, and malicious compaction, which are different from the accidental-harm and external-injection threats prior evaluations covered.
Design changes raise the bar measurably. Broader tool coverage, escaping and framing each transcript turn, and adding an agentic monitor stage each reduce success; escaping and framing specifically mitigates monitor injection.
Unmonitored edits are a separate hole. An agent can change what a previously approved command will run; monitoring edits prevents these execute-then-write attacks.
Multi-context attacks remain open. Spreading an attack across contexts defeats monitors that see only one; monitors that gather more context resist it but pay latency, and the authors state no acceptable-cost fix yet.
Abstract
To keep coding agents from going off the rails, production systems now review each proposed action with a blocking monitor that can reject it before it runs (Auto Mode in Claude Code, Guardian in OpenAI's Codex). Prior evaluations of such monitors largely measure robustness to accidental harm or prompt injections from untrusted sources looking to hijack the agent. Less understood is how they hold up when the agent they monitor is persistently misaligned. To understand this risk, we task an adversarial agent with evading production blocking monitors and causing catastrophic harm, e.g. by exfiltrating its own weights. We find that when instructed with high-level attack strategies, adversarial agents can succeed through several distinct mechanisms, such as agent-generated prompt injection against the monitor, multi-agent attacks, and malicious compaction. In particular we find that in 79% of trials, the agent can use an injection attack against Auto Mode and Guardian to run arbitrary bash commands. We also find that it is possible to greatly improve Auto Mode through design changes like enhancements to tool coverage, transcript formatting and an agentic monitor stage. Even with these improvements, preventing multi-context attacks at an acceptable cost remains an open problem. By detailing our red-teaming methodology and highlighting new attack vectors, we aim to help defenders evaluate their mitigations against the possibility of persistent malign coding agents. Code is available at https://github.com/safety-research/red-teaming-auto-mode.