Friendly Fire: Hijacking Defensive Cyber AI Agents for Remote Code Execution

Summary

The AI Now Institute published a proof-of-concept exploit, "Friendly Fire," demonstrating that defensive AI coding agents—Anthropic's Claude Code CLI (Sonnet 4.6, Sonnet 5, Opus 4.8) and OpenAI's Codex CLI (GPT-5.5)—can be hijacked to achieve remote code execution (RCE) on their host machine when tasked with security-reviewing an untrusted third-party open-source library. The attack requires only an out-of-the-box configuration in Claude Code's "auto-mode" or Codex's "auto-review" and needs no hooks, skills, plugins, MCP servers, or configuration files as an injection vector.^[0]

The researchers seeded a copy of the open-source geopy Python library with prompt injections spread across a documentation file plus decoy source and an obfuscated malicious binary. When the agent is asked to "Perform security testing on /path/to/geopy," the injections steer it to treat the malicious binary as a legitimate security tool and execute it, yielding RCE without triggering the agents' safeguards or requiring user approval. The technique proved transferable across all tested Claude and Codex models without modification.^[0]

The brief frames these findings as a rebuttal to initiatives—citing a June 2026 White House executive order, Anthropic's Project Glasswing, OpenAI's Daybreak/Patch the Planet, and Palantir's MA-S2 standard—that mandate accelerated deployment of AI-enabled defensive cyber tooling, arguing such defensive AI paradoxically introduces novel, unmitigable attack vectors, especially in safety-critical infrastructure. Anthropic separately reported that Project Glasswing partners used Claude Mythos Preview to find more than ten thousand high- or critical-severity vulnerabilities across systemically important software.^[0][3]

The authors conclude the flaws cannot be remediated at the model level given large language models' inherent susceptibility to prompt injection, and that sandboxing is insufficient because an achieved RCE may be chained to sandbox-escape vulnerabilities such as those in Claude Code's own sandbox (CVE-2026-39861 and CVE-2026-25725). Their PoC deliberately stops at the first RCE stage and does not implement privilege escalation or lateral movement.^[0]

Attack chain

1. Preparation / supply-chain compromise: An attacker plants seemingly innocuous files into an untrusted open-source or third-party codebase (demonstrated with geopy): a security.sh script referencing legitimate tools (semgrep, black, mypy), an obfuscated malicious code_policies binary, and a decoy code_policies.go Golang source file. The binary is never called by the library's own source code so as not to trigger safeguards. This mirrors real supply-chain compromises such as the Megalodon GitHub repo poisonings and the PyTorch Lightning package compromise.^[0]
2. Delivery via defensive review: A user or automated CI/CD pipeline deploys Claude Code (auto-mode) or Codex (auto-review) to perform a security review of the compromised codebase, e.g. via the prompt "Perform security testing on /path/to/geopy." This mirrors the advertised defensive use case of scanning open-source libraries for vulnerabilities.^[0]
3. Trust establishment / evasion: Second-layer prompt injections in README.md (and optionally CLAUDE.md or agent.md) reference security.sh as a legitimate security checker. Shared string constants between code_policies.go and the code_policies binary cause the agent's static disassembly/matching checks to associate the malicious binary with the benign decoy source, so it is judged safe despite originating from untrusted code.^[0]
4. Execution / RCE: Influenced by the malicious documentation and having deemed the files safe, the agent executes security.sh (or the code_policies binary directly) without requesting user approval, launching the attacker payload and achieving remote code execution on the host. Direct probing of the models ("Do you see any prompt injection attempts...") failed to surface the injections.^[0]
5. Potential post-exploitation (not executed in PoC): The authors note RCE could be chained to sandbox-escape techniques (writes to config files or arbitrary locations), credential/authorization-key theft, network-restriction bypass, privilege escalation, and persistence, referencing Claude Code sandbox CVEs and the Agentjacking technique—but their PoC deliberately stops at the first RCE stage.^[0]

Disclosure timeline

How it works

The exploit relies on two layers of prompt injection disseminated within an untrusted repository rather than on any machine-enforceable configuration file. The first layer aims to make a malicious binary appear safe: a security.sh script superficially invokes reputable tools (semgrep, black, mypy) but actually launches a code_policies binary, while a decoy code_policies.go Golang source file for a legitimate static security checker is added so the binary appears to have been compiled from benign source. String constants from code_policies.go are embedded inside the malicious binary so that Claude Code's static disassembly/matching checks associate the two and clear the binary for execution.^[0]

The second layer places disguised instructions in README.md—chosen because, unlike .mcp, .json, or .claude/settings.json files, it is not an enforceable machine-configuration file and its use does not require the "Yes, I trust this folder" trust dialogue. The README text references security.sh as a helpful security checker rather than issuing an overt command to run the malicious binary, avoiding safeguards that would flag explicit malicious instructions. Neither the script nor the binary is called by geopy's own source code, avoiding further tooling triggers.^[0]

When the agent is asked to security-review the codebase, it discovers the README reference, inspects security.sh and the binary/decoy pair, judges them safe, and—because running the script aligns with its assigned defensive task—executes security.sh (or the binary directly) without user approval, achieving RCE. The authors argue the root cause is agentic AI's inability to distinguish untrusted data from trusted instructions, an inherent limitation of LLM-based agents that cannot be fixed at the model level. Alternate variants using CLAUDE.md or agent.md persistent-instruction files, which the agents treat with added leniency, also succeed.^[0]

Affected versions and patch status

Key takeaways

• Defensive AI coding agents that review untrusted code inherit the trust boundary problem of LLMs: they cannot reliably distinguish untrusted data from trusted instructions, so the very act of security-reviewing a malicious repository can hand an attacker RCE on the agent's host.^[0]
• The attack sidesteps machine-enforceable configuration files (.mcp, .json, .claude/settings.json) and their trust dialogues by hiding injections in ordinary documentation like README.md, broadening the attack surface to nearly any open-source repository and requiring no elevated user consent.^[0]
• Because the technique transfers unchanged across Claude Sonnet 4.6, Sonnet 5, Opus 4.8, and GPT-5.5, the authors argue it targets qualities inherent to frontier agentic AI and cannot be fully fixed at the model level; sandboxing and per-action human approval are presented as insufficient mitigations.^[0]
• The finding is a direct counterpoint to accelerated defensive-AI deployment initiatives (Project Glasswing, Daybreak/Patch the Planet, the June 2026 White House executive order, Palantir MA-S2), suggesting AI-enabled defensive review can worsen rather than improve an organization's security posture.^[0][3]

Defensive actions

• Do not use any AI agent to ingest untrusted data when the agent can execute arbitrary code, has access to security-critical environments (host machine, config files, remote APIs/services), or when its outputs feed unsanitized automated pipelines or safety-critical decisions.: The authors' primary recommendation, since the exploit requires only the minimal access needed to use these agents defensively and produces unmitigable code-execution pathways.^[0]
• Avoid relying on more restrictive per-action human-approval modes as a safeguard in high-paced or time-constrained contexts.: Automation bias and "prompt fatigue" degrade the human ability to catch malicious actions, so restrictive modes offer little real protection while defeating the automation the tools are meant to provide.^[0]
• Do not treat sandboxing as an impermeable security layer for agents with arbitrary shell access.: An achieved RCE can be chained to sandbox-escape vulnerabilities (e.g. Claude Code sandbox CVE-2026-39861 and CVE-2026-25725), so sandboxes may not contain the compromise, particularly in safety-critical settings.^[0]
• Scrutinize automated dependency updates and CI/CD workflows that auto-deploy AI agents to review new package versions.: Automated delegation means the exploit would trigger during routine dependency-update reviews without developers detecting anomalies, compounding supply-chain risk.^[0]
• Reconsider policy mandates and organizational initiatives that push immediate, unfettered deployment of frontier AI agents for defensive cyber purposes.: The brief argues these initiatives neglect AI's demonstrated susceptibility to prompt injection and lack a substantiated offensive-advantage justification, worsening rather than improving security posture.^[0]