The filtering done by auto mode (generally) catches accidental prompt injection, but isn't effective against actual attacks: https://embracethered.com/blog/posts/2026/breaking-claude-co...

(Anthropic themselves acknowledges this; see the end of the post.)