Friendly Fire: Claude Code and Codex Driven to RCE from Untrusted Repos
Friendly Fire: Claude Code and Codex Driven to RCE from Untrusted Repos is a high-severity remote code execution issue in Claude Code CLI, an AI agent. Affected: Claude Code CLI 2.1.116, 2.1.196, 2.1.198, 2.1.199 (Sonnet 4.6/5, Opus 4.8); Codex CLI 0.142.4 (GPT-5.5).
Is Claude Code CLI running on your developers' machines? Anomity finds every device with this AI agent installed, shows the version, and can block it by policy. Detect this across your developers' devices with Anomity →
Key facts
- ID
friendly-fire-claude-code-and-codex-driven-to-rce-from-untrusted-repos- Severity
- high
- Attack type
- Remote code execution, Prompt injection
- Component
- Claude Code CLI · AI agent
- Known exploited
- No known exploitation
- Public exploit
- Yes
- Published
- Last verified
What is this vulnerability?
The AI Now Institute published a proof-of-concept (Friendly Fire) showing Claude Code and OpenAI Codex in autonomous review modes can be driven to remote code execution by malicious instructions hidden in README files, with binaries masked as compiled Go to evade disassembly checks. It targets the commonly recommended workflow of having an agent scan a third-party codebase.
Affected versions
| Affected | Fixed in |
|---|---|
Claude Code CLI 2.1.116, 2.1.196, 2.1.198, 2.1.199 (Sonnet 4.6/5, Opus 4.8); Codex CLI 0.142.4 (GPT-5.5) | No fixed version listed |
Am I affected by this vulnerability?
You are affected if you run Claude Code CLI 2.1.116, 2.1.196, 2.1.198, 2.1.199 (Sonnet 4.6/5, Opus 4.8); Codex CLI 0.142.4 (GPT-5.5).
How do I fix it?
Do not run untrusted repositories through coding agents in autonomous or auto-approve modes that can execute commands and reach secrets.
How do I find every machine running Claude Code CLI?
Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Claude Code CLI and which version, then enforce a policy on it.