Friendly Fire Attack: AI Coding Agents Tricked Into Running Malicious Code

Researchers at the AI Now Institute have published a proof-of-concept attack called ‘Friendly Fire’ that exploits AI coding agents designed to catch malicious code. The attack targets Anthropic’s Claude Code and OpenAI’s Codex when operating in autonomous modes that approve their own commands. Instead of detecting threats, the agents are tricked into executing attacker-controlled binaries hidden in open-source libraries.

The attack works by placing a few extra files into a library like geopy, with a README.md instructing the agent to run a script called security.sh. The script launches a hidden binary disguised as a harmless Go file. The agent reads the README, decides the script is part of the job, and runs it without warning. This bypasses safety checks because the instructions are hidden in a plain text file, not in configuration files that trigger trust prompts.

Testing showed the attack worked across multiple models, including Claude Sonnet 4.6, Sonnet 5, Opus 4.8, and GPT-5.5, with no changes needed. The researchers note that this design flaw cannot be fixed with a model update alone. They recommend not handing untrusted code to command-capable agents, and advise using sandboxing as a partial mitigation, though sandboxes have known escape vulnerabilities like CVE-2026-39861.

This attack follows similar research like Adversa’s ‘TrustFall’ and Tenet’s ‘Agentjacking,’ highlighting a broader vulnerability: untrusted text reaching agents that can run commands. The researchers have informed Anthropic and OpenAI, but the work falls outside formal disclosure programs.