Executive Summary
A proof-of-concept shows that autonomous coding agents used for security scanning may execute malicious code from the code they inspect. Organizations using Claude Code, Codex, or similar autonomous agents should review execution permissions and agent safeguards.
What Happened
Ask an AI coding agent to scan open-source code for security holes, and it might run the attacker's code on your own machine instead. That is the finding in a proof-of-concept published Wednesday by the AI Now Institute, an attack it calls "Friendly Fire." It works against Anthropic's Claude Code and OpenAI's Codex when either is running in an autonomous mode that approves its own
Affected Products
- Anthropic Claude Code
- OpenAI Codex
Vulnerability / Attack Technique
Malicious code execution through autonomous AI agent
Technical Mechanism
An AI coding agent is asked to scan open-source code for security holes, but may run attacker-controlled code on the user's machine instead. The reported attack works when Claude Code or Codex operates in autonomous mode and approves its own actions.
AI Security Category
LLM06:2025 Excessive Agency
Part of the AI Agent Excessive Agency topic.
Relevant Frameworks
RealGround Analysis
This issue matters because autonomous agents can combine code inspection with the ability to execute code, creating a dangerous trust boundary between untrusted repositories and developer environments. Teams running AI agents should constrain tool permissions, isolate execution, require human approval for high-impact actions, and test agent behavior against malicious repositories.
Recommended Controls
- Run agent-inspected code only in isolated, disposable sandboxes with no access to production systems, credentials, or sensitive files.
- Require explicit human approval before an agent executes repository code or invokes high-impact tools.
- Apply least-privilege permissions to agent processes, including restricted filesystem, network, and process-execution access.
- Use AI red-team tests containing malicious repositories and code-execution traps to validate autonomous-mode safeguards.
- Log and monitor agent tool calls, execution attempts, approvals, and accessed resources for anomaly detection and incident response.
Related RealGround Service
Secure AI Agent Build · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/07/friendly-fire-ai-agents-built-to-catch.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.