Top AI Agents Built to Catch Malicious Code Can Be Tricked Into Running It

Summary: The AI Now Institute published a proof-of-concept called "Friendly Fire" in which a README.md note telling an AI coding agent to run a security.sh script causes Claude Code and OpenAI Codex, in their autonomous modes, to execute a hidden attacker binary on the host. Written for Claude Sonnet 4.6, the same payload worked unchanged on Sonnet 5, Opus 4.8, and GPT-5.5, and when asked directly whether the geopy library held hidden instructions, both Claude Sonnet 4.6 and GPT-5.5 said no.
Why it matters: The attack hijacks the exact task these agents are sold for - vetting untrusted third-party code - and the researchers report no patch to wait for, because the models still cannot reliably separate the code they read from the instructions they follow. Teams that adopted command-capable agents to review outside code should weigh that against the researchers' blunt recommendation not to hand untrusted code to an agent that can reach your keys, secrets, or host.

Read the original at The Hacker News ↗