You ask an AI coding agent to scan open-source code for security flaws. Instead of finding threats, it runs the attacker’s code on your machine. That’s “Friendly Fire” — a new proof-of-concept from the AI Now Institute.
The attack works against Anthropic’s Claude Code and OpenAI’s Codex when they’re running in autonomous mode. That’s the mode where the agent approves its own commands. Instead of catching the threat, the agent becomes the way in.
Here’s how it plays out. The attacker drops a few extra files into an open-source library. A note in the README.md suggests running a script called security.sh as a routine check. The script launches a hidden binary carrying the real payload. The agent reads the README, decides the script looks like part of the job, and runs it. No warning, no approval box.
The researchers used the geopy Python library for the demo, but said it ports to almost any project. Crucially, the payload is hidden in README.md — a plain text file found in nearly every repository. Earlier attacks mostly abused config files like .mcp.json, which trigger trust prompts. This one sidesteps that.
One injection, two vendors, four models (Sonnet 4.6, Sonnet 5, Opus 4.8, GPT-5.5), no changes needed. The researchers say this can’t be fixed with a model update. The models still can’t reliably tell code from instructions.
There’s no evidence of exploitation in the wild yet. But with governments pushing AI agents into defensive security work, the gap this attack exposes matters.
The blunt recommendation? Don’t hand untrusted code to an agent that can run commands and reach your secrets. If you do anyway, watch for the agent executing binaries that only a README told it to run.
