{
  "entry": {
    "kind": "vuln",
    "slug": "friendly-fire-claude-code-and-codex-driven-to-rce-from-untrusted-repos",
    "name": "friendly-fire-claude-code-and-codex-driven-to-rce-from-untrusted-repos",
    "vendor": "Claude Code CLI",
    "description": "The AI Now Institute published a proof-of-concept (Friendly Fire) showing Claude Code and OpenAI Codex in autonomous review modes can be driven to remote code execution by malicious instructions hidden in README files, with binaries masked as compiled Go to evade disassembly checks. It targets the commonly recommended workflow of having an agent scan a third-party codebase.",
    "website": "https://thehackernews.com/2026/07/friendly-fire-ai-agents-built-to-catch.html",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-07-09",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "friendly-fire-claude-code-and-codex-driven-to-rce-from-untrusted-repos",
      "aliases": [
        "ti-049"
      ],
      "title": "Friendly Fire: Claude Code and Codex Driven to RCE from Untrusted Repos",
      "summary": "The AI Now Institute published a proof-of-concept (Friendly Fire) showing Claude Code and OpenAI Codex in autonomous review modes can be driven to remote code execution by malicious instructions hidden in README files, with binaries masked as compiled Go to evade disassembly checks. It targets the commonly recommended workflow of having an agent scan a third-party codebase.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Remote code execution",
        "Prompt injection"
      ],
      "componentType": "agent",
      "component": {
        "name": "Claude Code CLI",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "Claude Code CLI 2.1.116, 2.1.196, 2.1.198, 2.1.199 (Sonnet 4.6/5, Opus 4.8); Codex CLI 0.142.4 (GPT-5.5)",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": true,
      "publishedAt": "2026-07-09",
      "modifiedAt": "2026-07-09",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://thehackernews.com/2026/07/friendly-fire-ai-agents-built-to-catch.html"
        }
      ],
      "mitigation": "Do not run untrusted repositories through coding agents in autonomous or auto-approve modes that can execute commands and reach secrets.",
      "detectedByAnomity": true
    }
  }
}