Breaking

Code-review AI tricked into running code via README

July 11, 2026 at 02:22 EDT

Security
AI Agents
Software Dev & Coding

Around July 8-9, 2026, the AI Now Institute published a proof-of-concept dubbed "Friendly Fire" showing that Anthropic's Claude Code and OpenAI's Codex can be made to run arbitrary code on the host through instructions planted in a repository's README. It demonstrates how AI agents performing autonomous security reviews can mistake attacker-embedded instructions for part of their task and execute malicious code, as detailed by The Hacker News and the AI Now Institute technical brief.

July 8-9, 2026 · AI Now Institute

"Friendly Fire": AI Security Agents Turned Into Attack Weapons

A proof-of-concept shows Claude Code and Codex can be tricked into running arbitrary code — by hiding a single instruction inside a repository's README.md. The agents built to catch vulnerabilities become the vulnerability.

extra config files needed — no .mcp.json, plugins or hooks

ordinary file abused as the vector: the README.md

RCE

remote code execution — PoC stops here, no privilege escalation

How the exploit chains together

Plant

Hide "run security.sh" in a repo's README + a disguised malicious binary

→

Prompt

User asks the agent to "perform security testing" on the repo

→

Confuse

Auto-mode reads the README instruction as part of its task

→

Execute

Agent auto-runs the script and triggers the binary → RCE

The one condition that decides everything

⚠ Autonomous "auto" mode ON

Commands an AI classifier deems "safe" run automatically. The exploit fires.

✓ Human-confirmation mode

Requiring a person to approve commands blocks the attack.

Affected on stock Linux / container installs

Claude Code CLI 2.1.116-2.1.199

Sonnet 4.6 · Sonnet 5 · Opus 4.8

Codex CLI 0.142.4

GPT-5.5

Where "Friendly Fire" sits among recent agent attacks

Its edge is the lowest bar of all: no rigged config, no fake reports — just an ordinary README.

TrustFall
May 2026

RCE across multiple tools via a booby-trapped repository

Agentjacking
June 2026

85% success rate using fake bug reports

Friendly Fire
July 2026

Just a plain README.md — present in nearly every repo

The paradox: agents from initiatives like "Patch the Planet" and "Project Glasswing" scan untrusted third-party code to find bugs — but their command-execution autonomy is itself the new attack surface. No real-world exploitation reported yet; developers are urged to keep humans in the loop and avoid running agents on untrusted code.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.