Auto Mode Now Blocks the Credential-Exfiltration Path Most Prompt Injections Use: Cloud Metadata Fetches

TL;DR: v2.1.257 adds a Containment Escape rule — auto mode hard-blocks metadata credential endpoint fetches (AWS 169.254.169.254, GCP IMDS, Azure IMDS) and surfaces them for approval rather than executing silently.

What the threat is. A prompt injection in a document your agent reads can instruct it to curl http://169.254.169.254/latest/meta-data/iam/security-credentials/role-name — the AWS metadata endpoint that returns temporary IAM credentials. If auto mode's classifier doesn't catch this as a containment escape, the injected instruction runs and your cloud credentials leak. This is one of the most practical attack paths against agents running on cloud VMs or ECS tasks.

What changed. Before v2.1.257, auto mode evaluated metadata endpoint fetches case-by-case through the general safety classifier. Now they trigger a hard block: auto mode surfaces the operation for your approval before running it, even in fully unattended sessions.

What to check if your agent legitimately fetches instance metadata — for example, to retrieve its own region or IAM role name at startup — you'll see approval prompts where none appeared before. The fix is a scoped allow rule in your session config for that specific tool call pattern, not disabling auto mode:

// .claude/settings.json
{
  "permissions": {
    "allow": ["Bash(curl http://169.254.169.254/latest/meta-data/placement/region)"]
  }
}

Real limit: the Containment Escape rule applies only in auto mode. Standard permission-prompt mode was already surfacing unrecognized Bash commands; --dangerously-skip-permissions remains entirely outside this protection. If you're running unattended agents without auto mode, the metadata endpoint is still reachable.

Sources: Claude Code changelog v2.1.257 — code.claude.com · Breaking Claude Code Opus 5 Auto Mode with Indirect Prompt Injection — embracethered.com · Claude Code 2.1.251 security hardening — AI Stack Current