2026-07-09 · 2026-Q3
"Friendly Fire" Turns AI Code-Audit Agents Into Code Execution
Who actually said "do this"?
- Fixable
- Architectural
- Vendor response
- Unknown
- In the wild
- No
- Actor
- Attacker
Target
Anthropic Claude Code (CLI 2.1.116 through 2.1.199 on Sonnet 4.6, Sonnet 5, and Opus 4.8) and OpenAI Codex (CLI 0.142.4 on GPT-5.5) running in autonomous or auto-approval review modes
Impact
When these agents are asked to audit an untrusted third-party repository, a malicious binary disguised as a compiled build artifact (seeded with strings from legitimate source to defeat disassembly checks) plus instructions planted in a plain README drive the agent to run the payload on the developer's machine, turning a security-review tool into an execution vector. Newer models sometimes flagged that the binary did not match its supposed source and executed it anyway
Root cause
Models cannot reliably separate code they are analyzing from instructions embedded in documentation, a design-level weakness rather than a version-specific bug. Found by the AI Now Institute (Boyan Milanov, Heidy Khlaaf)
Sources
Catalog
Cite this: AgentProv incident record: "Friendly Fire" Turns AI Code-Audit Agents Into Code Execution (2026-07-09). https://agentprov.com/incidents/2026-07-09-friendly-fire-turns-ai-code-audit-agents-into-code-execution
Related
- Also L2 · 2026-10-15Datadog: Counterfeit Policy Text Collapses an Injection Classifier's Recall and Pushes a LangChain Risk Gate Under Its Block ThresholdL2Instruction
- Also L2 · 2026-10-08Cisco Talos: Four Malware Families Carry Instructions Aimed at the LLMs That Triage ThemL2Instruction
- Also L2 · 2026-10-07Barracuda: Phishing Emails Carry Hidden Prompt Injections for the Recipient's AI Inbox AssistantL2Instruction