Breaking

README-embedded prompts can trigger RCE in Claude Code and Codex auto modes

July 9, 2026 at 04:38 EDT

Security
AI Agents
Software Dev & Coding

Researchers at the AI Now Institute on July 8–9, 2026 released a proof-of-concept exploit dubbed "Friendly Fire" that hijacks Anthropic's Claude Code CLI and OpenAI's Codex CLI via prompt injection to run attacker-supplied binaries on the host. The key trait is that simply asking the agent to read code for a security review can lead to remote code execution (RCE), as detailed in the AI Now Institute brief and The Hacker News.

Jul 8–9, 2026 · AI Now Institute

"Friendly Fire": Defensive AI Agents Turned Into an Attack Path

A proof-of-concept hijacks Claude Code and Codex CLIs via prompt injection hidden in a library's README — so a simple request to "review this code for security" can trigger remote code execution on the host.

RCE

Attacker binary runs on the host — no hooks, plugins, or MCP servers needed

Agent CLIs affected — Claude Code (auto-mode) & Codex (auto-review)

Single injection succeeded across multiple foundation models

How the attack chains

1 · Plant

Hidden instructions in a library's README.md / source files

→

2 · Ask

User requests a "security review" of the code

→

3 · Execute

Agent auto-runs the attacker's binary on the host

Triggered only when auto-approval modes are on — the AI classifier waves through commands it deems "safe."

Tested surface

Versions and models where the single injection held.

2.1.116

2.1.196

2.1.198

2.1.199

Claude Code CLI · auto-mode

Sonnet 4.6 · Sonnet 5 · Opus 4.8

0.142.4

Codex CLI · auto-review

GPT-5.5

Column height reflects the number of vulnerable versions confirmed per target.

Limits of the PoC

Stops at initial RCE — no privilege escalation, lateral movement, or sandbox escape
Non-deterministic: success not guaranteed even at temperature 0
Published repo binaries replaced with benign versions

Why it matters

A design weakness a simple model update can't fully fix
Deploying defensive AI can itself open a new attack vector
Falls outside both vendors' formal disclosure programs

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.