Security agents designed to catch malicious code can be tricked into running it instead

Ask an AI coding agent to scan open-source code for vulnerabilities, and it might end up running the attacker's code on your machine. That's the finding from a proof-of-concept published Wednesday by the AI Now Institute, which calls the attack "Friendly Fire." It works against Anthropic's Claude Code and OpenAI's Codex when either is operating in an autonomous mode that approves its own commands. Instead of catching the threat, the agent becomes the entry point.

The attack hides in plain sight. Researchers Boyan Milanov and Heidy Khlaaf demonstrated the technique using geopy, a popular Python library for map coordinates, though they say it can be adapted to almost any project. They planted a simple suggestion in the README.md file - a routine note asking users to run a security script before opening a pull request. When an AI agent reads that instruction and follows it, the hidden binary executes on the host machine. No warning, no approval box. Claude Code's auto-mode and Codex's auto-review both use classifiers to decide which commands are safe, but the attack is designed to look unremarkable. In tests, both Claude Sonnet 4.6 and GPT-5.5 failed to flag any hidden instructions when asked directly.

This isn't a bug that can be patched with a software update. AI Now argues the weakness is fundamental to the design: the models still can't reliably distinguish between the code they're reading and the instructions they're meant to follow. Earlier attacks targeted configuration files, which at least trigger a trust prompt. This one hides in README.md, an ordinary text file found in nearly every repository, bypassing that safeguard entirely. The researchers point out that governments and vendors are pushing AI agents into defensive security work faster than the industry has closed this gap. Their blunt recommendation: don't hand untrusted code to an agent that can run commands and access your keys, secrets, or host. For teams that adopted these tools specifically to vet third-party code, that's an uncomfortable conclusion.

Source: The Hackers News