The rapid adoption of AI‑driven coding assistants has transformed how teams vet third‑party software, promising to catch vulnerabilities before they reach production. Yet a newly disclosed proof‑of‑concept from the AI Now Institute reveals a stark irony: the very agents tasked with hunting malicious code can be coerced into executing it on the reviewer’s own workstation. Dubbed “Friendly Fire,” the attack leverages the autonomous approval modes of Anthropic’s Claude Code and OpenAI’s Codex, turning a safety feature into an entry point. By embedding a seemingly innocuous instruction in a README file, the researchers showed that an agent can be convinced to run a hidden binary that carries the actual payload, all without triggering any trust prompts or user confirmation. This finding raises urgent questions about the trust models underpinning AI‑augmented development workflows and signals a need for immediate, practical safeguards.
At the heart of the exploit is a clever disguise: the malicious binary is placed alongside a harmless Go source file and is endowed with strings lifted from that source, causing the agent’s internal disassembly check to associate the two as a legitimate build artifact. The README then contains a simple directive—often phrased as a routine security check—that advises running a script named security.sh. When the agent, operating in its auto‑mode or auto‑review setting, scans the documentation, it interprets the script as part of the requested security assessment and launches it without hesitation. Because the classifier that governs autonomous actions judges the command as safe based on superficial characteristics, no warning dialog appears, and the payload executes directly on the host machine. The attack’s elegance lies in its reliance on ordinary repository artifacts rather than obscure configuration files, dramatically widening the potential attack surface.
Both Claude Code’s “auto‑mode” and Codex’s “auto‑review” sit between fully unrestricted access and a strict prompt‑for‑every‑action model. They employ a learned classifier that predicts whether a proposed command is benign enough to run automatically, pausing only on those flagged as risky. This design aims to preserve the convenience of hands‑free operation while still offering a safety net. However, the classifier’s decision boundaries are easily spoofed when the malicious artifact mimics legitimate code patterns, as demonstrated in the Friendly Fire scenario. Since the feature is opt‑in, organizations that have enabled it for productivity gains are inadvertently exposing themselves to a vector that requires no elevated privileges or special trust declarations—just a standard README in a third‑party library.
Critically, the researchers argue that this flaw is intrinsic to the agents’ interaction model rather than a bug in a specific version, meaning that simple version upgrades will not resolve the issue. The underlying problem is that the AI cannot reliably distinguish between the code it is supposed to analyse and the instructions it is meant to follow when both are presented as plain text within the same repository context. Consequently, any fix must involve workflow adjustments—such as disabling autonomous command execution for untrusted inputs or inserting mandatory human checkpoints—rather than waiting for a model patch. This distinction shifts the burden from model developers to end‑users, who must rethink how they integrate AI agents into security pipelines.
The exposure condition is deliberately narrow yet practically significant: the attack only succeeds when an autonomous agent is asked to review code that the reviewer does not control. In many open‑source consumption scenarios, this is precisely the case—developers routinely pull in libraries and run automated security scans before merging pull requests. The researchers chose geopy, a widely used Python geolocation package, as their demonstration target, but they emphasized that the technique transfers to virtually any project because it hinges on the presence of a README and a user‑invoked security‑style script. By dropping a few extra files into a library’s source tree, an adversary can turn a routine code‑quality check into a stealthy execution vector without altering the library’s functional code.
Friendly Fire joins a growing catalog of attacks that subvert AI‑assisted development tools, but it distinguishes itself by exploiting the most ubiquitous documentation file rather than niche configuration artefacts. Earlier campaigns such as Adversa’s TrustFall and Tenet’s Agentjacking manipulated .mcp.json, .claude/settings.json, or bug‑report fields to trigger unwanted behavior. Those avenues, while effective, often provoked trust warnings or required elevated access levels. By contrast, a README resides in virtually every repository, is routinely read by both humans and agents, and typically does not invoke any trust prompt. This makes the new vector far stealthier and applicable to a broader set of supply‑chain attacks, especially as organizations increasingly rely on automated pull‑request vetting.
From a market perspective, the disclosure arrives amid a surge in governmental and corporate mandates to embed AI agents into defensive security workflows. A June 2026 U.S. executive order, for example, encourages federal agencies to adopt AI‑based code scanning as part of their software supply‑chain risk management. Vendors have responded by promoting autonomous modes as productivity boosters, promising faster vulnerability detection with minimal human overhead. The Friendly Fire findings expose a dangerous misalignment: the push for automation is outpacing the maturation of safety guarantees. Security leaders must now weigh the efficiency gains against the risk of unintended code execution, particularly in environments where agents have access to source‑tree secrets, build credentials, or deployment keys.
Practical mitigation begins with a fundamental principle: never grant an AI agent that can execute arbitrary commands direct access to untrusted code unless its autonomous command mode is disabled. Organizations should treat any request to run scripts or binaries originating solely from documentation as a high‑risk indicator and enforce mandatory human approval for such actions. Where autonomous operation is required for trusted internal repositories, consider implementing whitelisting of allowed commands, integrating robust sandboxing, and maintaining detailed audit trails of every agent‑initiated process. Additionally, employing source‑code integrity checks—such as verifying signatures or hashes before inviting an agent to review—can prevent malicious file injection at the source.
Sandboxing, while a valuable layer of defense, is not a panacea. The researchers note that the tested setup lacked any isolation, allowing the payload to run directly on the host. Even when a sandbox is employed, sophisticated escape techniques remain a threat; recent vulnerabilities in Claude Code’s own sandbox (e.g., CVE‑2026‑39861 involving symlink manipulation) demonstrate that determined attackers can break out of confined environments. Therefore, sandboxing should be viewed as one component of a defense‑in‑depth strategy, complemented by least‑privilege principles, endpoint detection and response (EDR) monitoring, and strict network segmentation for AI agent workloads.
Detection hinges on observing behavioral anomalies that deviate from normal agent activity. Security teams should create alerts for any instance where an AI agent launches a binary or script that was referenced only in a README, documentation file, or similar non‑code artifact, especially if the execution occurs without prior user interaction. Logging the full command line, process ancestry, and file accesses associated with agent‑initiated actions enables forensic analysis and facilitates the identification of patterns indicative of Friendly Fire‑style abuse. Integrating these signals into a Security Information and Event Management (SIEM) system can provide early warning before payloads achieve deeper objectives such as credential harvesting or lateral movement.
Developers and maintainers of third‑party libraries also bear responsibility for mitigating supply‑chain risks. Adopting practices such as signing release artifacts, maintaining reproducible builds, and publishing clear, auditable security‑checking procedures can reduce the likelihood that malicious modifications go unnoticed. Encouraging consumers to verify integrity via established package‑manager mechanisms (e.g., PGP signatures, checksums) adds another hurdle for attackers attempting to inject harmful binaries. Furthermore, maintaining a minimalistic README that avoids prescribing automatic execution of external scripts limits the avenues through which an AI agent can be misled.
To safeguard your organization against the Friendly Fire threat and similar AI agent abuses, consider implementing the following actionable checklist: 1) Disable autonomous command execution for any AI agent tasked with reviewing external or unverified code. 2) Enforce mandatory human approval for all script or binary launches triggered by documentation. 3) Deploy sandboxed or containerized environments for agent operations, monitoring for escape attempts. 4) Integrate runtime anomaly detection focused on unexpected process spawns from agents. 5) Verify the integrity of third‑party dependencies via cryptographic signatures before permitting agent review. 6) Educate security and development teams on the specific indicators of documentation‑based command injection. By aligning tooling, policy, and vigilance, teams can retain the productivity benefits of AI‑assisted code review while substantially reducing the risk of turning their own guardians into inadvertent accomplices.