Top AI Agents Built to Catch Malicious Code Can Be Tricked Into Running It

Researchers have demonstrated a novel method to bypass the safety mechanisms of AI coding assistants, using a technique dubbed 'Friendly Fire.' The attack targets Anthropic's Claude Code and OpenAI's Codex when operating in autonomous modes—specifically versions 2.1.116–2.1.199 of Claude Code and 0.142.4 of Codex. By embedding a malicious script within a seemingly benign README.md file in an open-source project, attackers can trick the AI agent into executing arbitrary code on the host machine. The vulnerability lies in how these tools interpret and act upon instructions found in documentation files, rather than in their core codebase. While no active exploitation has been reported, the flaw highlights a critical design issue that cannot be resolved through model updates alone. Developers are advised to avoid running untrusted code through command-capable agents unless strict manual oversight is applied.