A newly-disclosed exploit in Claude Code’s ‘auto-mode’ leaves developers facing remote code execution (RCE) vulnerabilities during third-party library reviews. The AI Now Institute disclosed a proof-of-concept demonstrating how a routine third-party code review can be weaponised into a full host compromise on the machine running the AI coding agent.
The attack works against stock Claude Code CLI (versions 2.1.116 through 2.1.199) with Claude Sonnet 4.6, Sonnet 5, or Opus 4.8 in auto-mode, and against Codex CLI 0.142.4 with GPT-5.5 in auto-review. No hooks, skills, plugins, MCP servers, or custom configuration files are required.
Software developers who point these agents at open-source packages for vulnerability discovery now carry a concrete host-level exposure. The same access needed for defensive scans supplies the path an attacker needs.
Roey Eliyahu, CEO and Co-founder of Salt Security, said: “Friendly Fire, GitLost, Agentjacking, TrustFall… Four documented attacks in the past two months. Different techniques, same underlying condition: untrusted text reaches an agent that can run commands. The agent cannot reliably tell the difference between the code it is reviewing and the instructions it is being given. And the attacker’s payload executes on the host.
“The AI Now researchers make the point that matters most: this is not a model problem you can patch. Claude Sonnet 4.6, Sonnet 5, Opus 4.8, GPT-5.5, one payload, all four models, no modifications needed. When the same attack works unchanged across two vendors and four model generations, you are not looking at a software bug—you are looking at a structural property of how these agents work.”
Expanding the coding agent attack surface
Claude Code and Codex ship auto-mode and auto-review settings that let an AI classifier approve shell commands the model judges safe.
Vendors present these modes as the practical default for long-running agentic work, including vulnerability research, so a developer can start a task without constant manual prompts. The AI Now researchers installed the agents on a Linux host or container, placed a local copy of a modified geopy library on disk, and issued a single natural-language instruction to perform security testing on that path.
The agents explore the repository, read documentation that frames a helper script as useful for security checks, inspect a binary that appears backed by matching source, and execute it because the documentation aligns with the original review task. The binary then runs attacker-controlled code on the host.
Neither the script nor the binary is called by legitimate library functions, which keeps traditional static checks quiet. When the researchers later asked the underlying models whether prompt injection attempts existed in the source, Claude Sonnet 4.6 and GPT-5.5 both failed to flag the material.
The technique transfers across the tested models without modification. In some runs, Sonnet 5 or Opus 4.8 notes that certain files do not belong to the upstream project, yet still proceeds to execution. The researchers also succeeded with variations that place instructions in CLAUDE.md or agent.md files, which the agents treat as persistent project context.
Two realistic scenarios map onto everyday developer practice. First, a library maintainer can embed undisclosed instructions that steer coding agents; earlier public examples already showed agents instructed to delete test suites.
Second, a supply-chain compromise of a popular package or repository can insert the same material. Automated dependency updates and CI jobs that invoke an agent to “review the new version” then become the trigger. In that workflow the developer never opens the poisoned files; the agent does.
Sandboxing does not close the gap once the agent holds RCE. The researchers note prior sandbox issues disclosed against Claude Code itself. An attacker who already runs code on the host can probe the sandbox, write configuration, steal keys, or establish persistence.
Restrictive approval modes that demand human confirmation for every command remove the automation benefit that drove teams to adopt the tools. Automation bias and prompt fatigue further weaken the human check, especially under time pressure or when non-security staff operate the agents.
Impact on day-to-day development and CI practice
Any developer workstation or CI runner that grants an agent shell access and then feeds it untrusted source inherits this path.
The attack does not require the user to accept a “trust this folder” dialogue of the kind associated with configuration-file injections. README-level documentation and ordinary source files are enough. Because the agents execute arbitrary commands as part of their design, pattern-matching safeguards inside the model cannot enumerate every syntactic variant an attacker can use to disguise intent.
The AI Now Institute published a Friendly Fire repository that contains the supporting files and a stripped, benign binary so researchers can examine the structure safely. The original payload is available only on request to AI labs and security researchers. The work does not chain the initial execution into privilege escalation or lateral movement; the goal is to show that the first stage is already reachable under default defensive usage.
Engineering organisations that rely on open-source libraries or ingest external code should stop handing untrusted repositories to any agent that can run shell commands or reach host filesystems, credentials, configuration, or remote APIs. Agents whose outputs feed automated pipelines without sanitisation, or that inform security decisions, create the same exposure. More restrictive human-in-the-loop modes still leave residual risk when operators lack the expertise or attention to catch the deception.
Teams that continue to experiment with these tools should isolate them on machines that hold no production secrets, no broad filesystem mounts, and no network paths to internal services. Runtime monitoring that watches agent actions – rather than only credentials – can surface deviations such as execution of a binary never referenced by the legitimate codebase.
Traditional static analysis, dependency pinning, checksum verification, and human review remain the primary controls for third-party code until agent architectures separate untrusted content from executable instructions more reliably.
Roey Eliyahu commented: “The recommendation they (the AI Now Institute) land on is exactly right and exactly uncomfortable: do not hand untrusted code to an agent that can run commands and reach your keys, secrets, or host. That is the job these tools are being sold for. And it is the job that exposes the gap.
“What I would add is that the gap is visible before the attack happens, not just after. Every agent in your environment that has access to credentials, secrets, or the host filesystem is a potential Friendly Fire scenario. The question is not whether your agents have this exposure. It is whether you know which ones do, what they can reach, and whether their behaviour is being monitored at the action layer.
“The README that tricks Claude Code into running a malicious binary is not detectable at the credential layer—it is detectable at the behavioural layer: an agent executing a binary or script that nothing in the legitimate codebase ever calls. That deviation from expected behaviour is exactly what runtime monitoring at the action layer is designed to surface.”
Decision-makers pushing rapid adoption of frontier agents for defensive scanning of open-source and third-party code should reassess the risk before those agents sit on developer laptops or inside CI systems that touch production assets. The access model required for the advertised defensive use case is the same access model the attack requires.
See also: IBM and Red Hat automate open-source vulnerability remediation
Want to learn more about cybersecurity from industry leaders? Check out Cyber Security & Cloud Expo taking place in Amsterdam, California, and London. The comprehensive event is part of TechEx and is co-located with other leading technology events including the AI & Big Data Expo. Click here for more information.
Developer is powered by TechForge Media. Explore other upcoming enterprise technology events and webinars here.
