Top AI Agents Built to Catch Malicious Code Can Be Tricked Into Running It

Ask an AI coding agent to scan open-source code for security holes, and it might run the attacker's code on your own machine instead. That is the finding in a proof-of-concept published Wednesday by the AI Now Institute, an attack it calls "Friendly Fire." It works against Anthropic's Claude Code and OpenAI's Codex when either is running in an autonomous mode that approves its own

According to AI Now Institute’s "Friendly Fire" proof-of-concept, autonomous defensive coding agents such as Anthropic’s Claude Code and OpenAI’s Codex can be hijacked via prompt injections hidden inside third‑party codebases, causing the agent to execute attacker-controlled binaries on the host machine instead of merely reviewing them.[1][8][9] The exploit works in out-of-the-box autonomous modes (e.g., auto-mode/auto-review) by convincing the agent that running a malicious binary is required to complete the security assessment, leading to remote code execution on the defender’s system.[1][8] From a RealGround perspective, this highlights a critical AI agent abuse risk where defensive agents become an execution vector, requiring secure agent design (no auto-approval of high-risk actions), business-logic-level guardrails on tool use, sandboxing of code execution, and continuous red teaming of agent workflows that interact with untrusted repositories and open-source code.