Loading story…
AI Now Institute disclosed "Friendly Fire," a proof-of-concept attack showing that autonomous AI coding agents used to inspect or secure software repositories can be manipulated into executing attacker-controlled code on the host system. The demonstration targeted Anthropic Claude Code and OpenAI Codex when autonomous command-approval features were enabled, and used a malicious README prompt plus a disguised binary invoked through a script named security.sh while reviewing an untrusted open-source repository.
Researchers said the issue is a design-level weakness rather than a patchable, version-specific flaw, because the agents cannot reliably separate hostile repository content from instructions that appear relevant to their assigned task. The proof of concept, built from a modified geopy repository, reportedly required no elevated privileges or trust prompt and achieved code execution without user approval; AI Now said it has not observed in-the-wild abuse, released public research code with the payload removed, and urged organizations to keep command-capable agents away from untrusted codebases and sensitive environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
AI Now Institute published an exploit brief describing 'Friendly Fire,' a proof-of-concept attack showing that autonomous AI coding agents can be manipulated into executing attacker-controlled code while reviewing untrusted repositories. The research demonstrated the issue against Anthropic Claude Code and OpenAI Codex in autonomous command-approval modes and released public code with the payload removed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcethehackernews.com
Open sourceainowinstitute.org
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers at Adversa AI disclosed **GuardFall**, a shell-interpretation bypass that affects 10 of 11 surveyed open-source AI coding and computer-use agents, allowing malicious commands to slip past safety filters. The flaw stems from agents checking raw command text while `bash` later rewrites and evaluates that text through expansion, substitution, and quote handling, enabling decades-old evasion techniques such as quoted token splitting, `$IFS` expansion, command substitution, and encoded pipelines. Adversa reported successful end-to-end exploitation against the production **Plandex** binary and said vulnerable agents include **Hermes, opencode, Goose, Cline, Roo-Code, Aider, Plandex, Open Interpreter, OpenHands, and SWE-agent**, while **Continue** was the only surveyed tool found to substantially mitigate the issue through structural command parsing and recursive analysis. The attack becomes especially dangerous when an agent is induced by untrusted content—such as poisoned **READMEs, Makefiles, MCP server responses, package metadata, or repository configuration files**—to emit commands that are then auto-executed on the user’s host. Adversa warned that successful exploitation could expose **SSH keys, cloud credentials, and files in `$HOME`**, and noted that sandbox protections can disappear when agents are run in documented local-host modes. No public in-the-wild exploitation was reported, but researchers urged users to disable auto-execute features, isolate or redirect `$HOME`, avoid running agents on forked pull requests, audit repository-shipped configs, and adopt tokenize-and-canonicalize command enforcement instead of regex or raw-string blocklists.
Jul 2, 2026
Mozilla’s **0DIN** researchers demonstrated a supply-chain-style proof of concept in which an AI coding agent such as **Claude Code** can be manipulated into compromising a developer’s machine while cloning and initializing a seemingly benign GitHub repository. The repository itself can appear clean, with a legitimate-looking `README` and no obviously malicious code, but a staged setup flow causes a package to fail until initialization and prompts the agent to run follow-up commands it interprets as routine recovery steps. In the demonstrated chain, an initialization script fetched attacker-controlled data from a **DNS TXT** record and executed it, with the TXT record carrying a base64-encoded reverse-shell payload that could give the attacker interactive access under the developer’s privileges. Researchers warned that such access could expose environment variables, API keys, local configuration files, source code, documents, browser sessions, passwords, and enable persistence, while remaining difficult for scanners, human reviewers, and AI agents to detect because each step appears normal in isolation. They said threat actors could distribute these repositories through fake job offers, tutorials, blog posts, or direct messages, and urged agentic tools to reveal the full execution chain, including dynamically fetched scripts and runtime code.
Jun 29, 2026
New research shows that **AI assistants and coding agents can be manipulated by hidden or misleading instructions embedded in content they process**, creating a practical path to social engineering, data leakage, and potentially malicious command execution. LayerX reported that a **custom font and CSS-based rendering attack** can make a webpage appear harmless in the DOM while showing different instructions to the user in the browser, exploiting the gap between what AI systems analyze and what humans actually see. In its proof of concept, a page that looked like benign fanfiction at the HTML level rendered instructions that could steer a user toward executing a reverse shell, and the company said major AI assistants it tested failed to detect the threat. Separate research highlighted a related **semantic injection** risk in software repository `README` files used by AI coding agents. In testing, attackers embedded malicious setup-style instructions into documentation so agents would exfiltrate local files or other sensitive data to external servers during project setup, with reported success rates of up to **85%**. The benchmark, *ReadSecBench*, used 500 open source repositories across multiple programming languages and found the attack worked across agents using models from **Anthropic, OpenAI, and Google**, indicating that hidden-instruction attacks are not limited to one interface or vendor but reflect a broader weakness in how AI systems interpret untrusted content and operational guidance.
Jun 29, 2026