By ByteBot
The tool you deployed to catch malicious code just ran it instead. On July 8, the AI Now Institute published “Friendly Fire” — a proof-of-concept showing that Claude Code and Codex, when tasked with auditing an untrusted library, can be tricked into executing attacker-controlled binaries on your machine. No CVE. No patch. No vendor response. The name is fitting: your AI defender becomes the attack path.
How It Works
Researcher Boyan Milanov constructed a weaponized copy of geopy, a widely used Python geocoding library. Embedded in it were four components designed to fool an AI agent conducting a security review:
- A malicious binary named
code_policies, disguised as a static analysis tool - A decoy Golang source file (
code_policies.go) to make the binary appear legitimately compiled - A wrapper script (
security.sh) that references standard security tooling and calls the binary - A README injection steering the agent to run
security.shas part of its review workflow
The attack sequence is deceptively simple. The developer types something like “Perform security testing on /path/to/geopy.” The agent reads the documentation, hits the injected README, inspects the decoy source file, concludes the binary is a legitimate audit tool, and executes it. RCE achieved. No approval dialog. Nothing looks wrong. The whole thing plays out exactly as a legitimate security review would — except the review is running attacker code.
This works against stock Claude Code CLI (versions 2.1.116 through 2.1.199) in auto-mode with Sonnet 4.6, Sonnet 5, or Opus 4.8, and against Codex CLI 0.142.4 in auto-review with GPT-5.5. No plugins, hooks, MCP servers, or custom configuration required. Out of the box.
The Finding That Should Worry You Most
The same payload worked unchanged across all four model configurations. That alone is bad enough. But the detail that stops you cold: in some runs, Sonnet 5 and Opus 4.8 noticed that the binary did not match its supposed source code. Then ran it anyway.
Smarter models flagged the inconsistency and executed the payload regardless. Upgrading your model version is not a mitigation. The attack targets the trust model of autonomous agents — agents in auto-mode are pre-authorized to run shell commands, so no additional approval is sought. The injections do not need to bypass a safety check; they just need to convince the agent this is normal workflow.
Why There Is No Patch Coming
Milanov disclosed to both Anthropic and OpenAI before publishing. No CVE has been assigned. No PSIRT thread. No coordinated patch date. IT Pro approached both companies for comment and received no response by publication time.
AI Now’s position is direct: this is a design-level flaw, not a code bug. The agents are doing exactly what they were asked — reviewing the repo, following documented tooling, running what looks like a legitimate security script. Vendors do not classify “the agent should not trust an untrusted repo’s suggested workflow” as a security defect. That is a policy problem, and policy problems do not ship in patch notes.
This fits a pattern that is hard to ignore. GuardFall, published June 30, showed that 10 of 11 popular AI coding agents — representing over 548,000 GitHub stars combined — are bypassed by shell injection tricks that are decades old. AutoJack, published June 18, chained three vulnerabilities to achieve host code execution from a malicious web page. Friendly Fire lands July 8. Three agentic RCE exploits in three weeks, from different attack surfaces, converging on the same conclusion: AI coding agents are expanding your attack surface faster than the security community can characterize it.
What To Do Right Now
The mitigations here are workflow changes, not software updates. AI Now’s recommendation is direct: stop using autonomous AI agents to review code you do not control.
- Disable auto-mode and auto-review for external repositories. This is the single most effective mitigation. If you are reviewing a third-party library or open-source dependency, do not hand it to an agent with pre-authorized shell execution.
- Isolate agent execution environments. Run reviews inside containers or VMs with no access to host credentials, filesystem, or network resources beyond what the task requires.
- Apply OS-level process controls. Seccomp profiles or AppArmor rules restricting the agent process to read-only filesystem access and no binary execution cover a significant portion of the risk surface.
- Audit agent plans before execution. If your workflow requires auto-mode, review the full execution plan before the agent proceeds — most agents support a dry-run or plan-preview mode.
- Review Anthropic’s updated guidance for automated security reviews in Claude Code, which covers trusted-repository configuration and GitHub Actions approval gating.
The proof-of-concept repository is live on GitHub with the payload stripped. No in-the-wild exploitation has been reported as of this writing. That window will not stay open indefinitely.
