A new proof-of-concept attack shows that AI coding agents built to scan open-source code for vulnerabilities can be manipulated into executing malicious commands on the host machine. Dubbed 'Friendly Fire' by the AI Now Institute, the attack targets Anthropic's Claude Code and OpenAI's Codex when running in autonomous mode, where the agent approves its own commands. Instead of catching threats, the agent becomes the entry point.

Researchers Boyan Milanov and Heidy Khlaaf tested stock installations of Claude Code and OpenAI Codex with autonomous features enabled. The attack hides malicious payloads in ordinary files like README.md, avoiding trust prompts that flag configuration file changes. In the demo, a fake security script in a library's README was executed by the agent, running a hidden binary disguised as a harmless Go compilation. The researchers found that both Claude Sonnet 4.6 and GPT-5.5 failed to detect the deception, even when asked directly about hidden instructions.

The attack works across multiple models and versions without modification, leading AI Now to argue the flaw is in the design, not the code. There is no patch, only a workflow change: never hand untrusted code to an agent that can run commands and access keys or secrets. While no real-world exploitation has been reported, the researchers warn that governments and vendors are pushing AI agents into security work faster than the gaps are closed. The same failure mode has appeared in prior attacks like TrustFall and Agentjacking, underscoring a persistent weakness: AI agents cannot reliably distinguish code from instructions.

Source: The Hackers News