Source: AI Now Institute — 2026-07-08

Summary

AI Now Institute published a proof-of-concept, dubbed "Friendly Fire," showing that Claude Code and OpenAI's Codex CLI can be tricked via prompt injection embedded in an ordinary README.md into executing a malicious binary — when run in an auto-mode/auto-review setting to security-review a third-party repository. No hooks, plugins, MCP servers, or special config files are required as the injection vector; plain documentation text embedded in the repo is enough to turn the defensive code-review agent into the infection path.

Key Takeaways

• Demonstrated against Claude Sonnet 4.6, Claude Sonnet 5, Claude Opus 4.8, and OpenAI's GPT-5.5-powered Codex CLI — the payload written against Sonnet 4.6 worked unmodified against all the others.
• Proof-of-concept used a modified copy of the popular geopy Python library, adding a fake "routine check" security.sh script plus a hidden binary disguised behind a decoy Go source file.
• Anthropic has shipped three patches over the past six months for config-file-based prompt injection, but this README-based route sidesteps that entire mitigated class.
• Currently unpatched — the researchers frame it as a workflow-design issue (agents trusting repo documentation as instructions) rather than a specific software bug; no in-the-wild exploitation has been reported.

Discussion