The guardrail is the same wire as the action it polices

Autonomous coding agents now run on the same channel that is supposed to police them, and that is the structural reason prompt-injection attacks keep landing. The pattern is not "AI is unsafe." It is that an in-process classifier cannot be the trust boundary for a system it both permits and polices, because the attacker and the defender share the prompt.

Rehberger's reproducible finding, reported by Simon Willison, makes the mechanism visible. A prompt steers Claude Code into downloading and unpacking an archive, then importing a local struct.py the archive plants. About 80 percent of the time, the attack lands. The counter-intuitive part is what happens next: when the agent detects the compromise and tries to terminate the malicious process, Auto Mode's classifier refuses the kill command. The safety layer green-lights the harm and red-lights the cure.

Any coding agent that ships a single in-band classifier as its primary defense has the same shape: the guardrail is the same wire as the action it polices, so the attacker wins once while the defender must win every turn. Independent prompt-injection work in mid-August corroborated the bypass.

The fix is external. Rehberger's mitigation list, carried by Willison, is the right read: run unattended agents inside a container or VM, restrict network egress, and never expose the home directory, SSH keys, or cloud credentials to the run. Tighter prompts will not close this. A different boundary will.