Friendly Fire Hijacks AI Coding Agents Into Host-Side Code Execution

AI Now Institute disclosed "Friendly Fire," a proof-of-concept attack showing that autonomous AI coding agents used to inspect or secure software repositories can be manipulated into executing attacker-controlled code on the host system. The demonstration targeted Anthropic Claude Code and OpenAI Codex when autonomous command-approval features were enabled, and used a malicious README prompt plus a disguised binary invoked through a script named security.sh while reviewing an untrusted open-source repository.

Researchers said the issue is a design-level weakness rather than a patchable, version-specific flaw, because the agents cannot reliably separate hostile repository content from instructions that appear relevant to their assigned task. The proof of concept, built from a modified geopy repository, reportedly required no elevated privileges or trust prompt and achieved code execution without user approval; AI Now said it has not observed in-the-wild abuse, released public research code with the payload removed, and urged organizations to keep command-capable agents away from untrusted codebases and sensitive environments.