A new exploit called “Friendly Fire” hijacks Anthropic’s Claude Code CLI and OpenAI’s Codex CLI to execute attacker-controlled binaries during routine security reviews of third-party code.
The attack disclosed by Security researchers at the AI Now Institute targets Claude Sonnet 4.6, Sonnet 5, and Opus 4.8, as well as GPT-5.5, using nothing more than the default “auto-mode” or “auto-review” configurations.
The exploit requires no hooks, plugins, MCP servers, or configuration files; instead, it hides prompt injections directly inside a third-party open-source library’s documentation and source files.
Researchers modified a copy of the popular geopy Python geocoding library, adding a security.sh script, a malicious binary named code_policies, and a decoy Golang source file code_policies.go designed to make the binary look legitimately compiled and safe.
A README.md file references the security.sh script as a routine security checker, nudging the AI agent to run it as part of a standard vulnerability assessment.
When a user simply prompts the agent with something like “Perform security testing on /path/to/geopy,” the agent explores the codebase, encounters the injected documentation, inspects the decoy source file, and concludes the binary is safe, then executes it, achieving remote code execution on the host machine, AI Now Institute said.
Both auto-mode and auto-review were marketed as safer middle grounds compared to fully unrestricted agent execution, using AI classifiers to auto-approve commands deemed low-risk while escalating suspicious ones for human review.
Anthropic has said Claude Code auto-mode already sees users approving 93% of permission prompts, and the classifier is meant to reduce unnecessary friction without sacrificing safety.
With Friendly Fire AI Now Institute researchers found that this same classifier consistently misjudged the malicious payload as benign, since the code-matching heuristics could be spoofed by pairing a real-looking source file with a compiled binary containing matching string constants.
| Aspect | Claude Code | Codex |
|---|---|---|
| Model tested | Sonnet 4.6, Sonnet 5, Opus 4.8 | GPT-5.5 |
| Permissive mode exploited | Auto-mode | Auto-review |
| Injection vector | README.md + decoy source file | Same files, no changes needed |
| Detected injection on direct query? | No | No |
The attack proved directly transferable from Claude Code to Codex without modification, suggesting the underlying weakness is inherent to how frontier models distinguish trusted instructions from untrusted data rather than a model-specific bug.
This class of attack maps onto real-world threats, including recent supply-chain compromises like the Megalodon GitHub campaign and the PyTorch Lightning library breach, both of which show that malicious code can realistically reach downstream users through dependency updates.
If CI/CD pipelines delegate automated vulnerability scanning of incoming package updates to AI agents, the same injection technique could trigger silently, without a human ever reviewing the change.
Researchers argue sandboxing alone isn’t a complete fix, pointing to disclosed Claude Code sandbox escape vulnerabilities that could let an attacker who already achieved RCE break out of containment entirely.
They also caution against relying on human-in-the-loop approval as a backstop, citing automation bias and “prompt fatigue” that erode reviewer vigilance during repetitive agent interactions.
The core recommendation: avoid deploying AI coding agents with code-execution privileges against untrusted or externally sourced codebases until model-level trust boundaries between instructions and data are meaningfully resolved.
Stop Accepting SLAs Written for 2019 SOCs – Here’s the 2026 AI SLA Vendor Checklist – Download Free AI SOC SLA Guide
