In a conspicuous revelation that has sent trepidation through the software development community, researchers have uncovered a malignant vulnerability in autonomous coding agents.
The "Friendly Fire" paradigm
The AI Now Institute recently elucidated a proof-of-concept exploit ominously dubbed "Friendly Fire," which demonstrates how routine third-party code reviews can be repurposed into full host compromises.
Our latest research, “Friendly Fire,” uncovers a proof-of-concept exploit that shows autonomous coding agents like Claude Code and OpenAI Codex can be hijacked to execute malicious commands hidden in the code they are reviewing.
— AI Now Institute (@AINowInstitute) July 10, 2026
Mechanics of the machination
The susceptibility fundamentally targets the "auto-mode" and "auto-review" settings embedded within stock Claude Code CLI and Codex CLI. These modes, conceived to streamline agentic workflows by automatically sanctioning shell commands deemed safe, inadvertently create a quagmire for security.
When developers direct these agents to scrutinize open-source packages, the AI explores the repository and reads documentation. If an attacker has embedded clandestine instructions within helper scripts or binaries, the agent, unable to discriminate between legitimate code and injected prompts, executes the payload on the host machine.
Critical Determination: Roey Eliyahu, CEO of Salt Security, posited that this is not a mere software anomaly to be ameliorated with a simple patch. Because the identical attack vector operates flawlessly across multiple model generations from different vendors, it exposes a fundamental structural property of how these autonomous agents process untrusted text.
Supply Chain Ramifications
The gravity of this exploit is magnified by its alignment with everyday developer practices. Automated dependency updates and Continuous Integration (CI) pipelines that conjure an agent to review new library versions become the exact catalyst for compromise. In this construct, the developer never manually opens the poisoned files; the agent does, unwittingly precipitating a full system breach.
As the industry grapples with this revelation, the focus must transition from merely patching models to architecting robust perimeters that can reliably sequester agent execution environments from the underlying host infrastructure.