# friendly-fire-claude-code-and-codex-driven-to-rce-from-untrusted-repos: Friendly Fire: Claude Code and Codex Driven to RCE from Untrusted Repos

> Friendly Fire: Claude Code and Codex Driven to RCE from Untrusted Repos is a high-severity remote code execution issue in Claude Code CLI, an AI agent. Affected: Claude Code CLI 2.1.116, 2.1.196, 2.1.198, 2.1.199 (Sonnet 4.6/5, Opus 4.8); Codex CLI 0.142.4 (GPT-5.5).

- **Canonical URL:** https://catalog.anomity.ai/vuln/friendly-fire-claude-code-and-codex-driven-to-rce-from-untrusted-repos
- **Aliases:** ti-049
- **Severity:** high
- **Attack type:** Remote code execution, Prompt injection
- **Component:** Claude Code CLI (AI agent)
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-07-09
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/friendly-fire-claude-code-and-codex-driven-to-rce-from-untrusted-repos

## Summary

The AI Now Institute published a proof-of-concept (Friendly Fire) showing Claude Code and OpenAI Codex in autonomous review modes can be driven to remote code execution by malicious instructions hidden in README files, with binaries masked as compiled Go to evade disassembly checks. It targets the commonly recommended workflow of having an agent scan a third-party codebase.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| Claude Code CLI 2.1.116, 2.1.196, 2.1.198, 2.1.199 (Sonnet 4.6/5, Opus 4.8); Codex CLI 0.142.4 (GPT-5.5) | no fixed version listed |

## Am I affected by this vulnerability?

You are affected if you run Claude Code CLI 2.1.116, 2.1.196, 2.1.198, 2.1.199 (Sonnet 4.6/5, Opus 4.8); Codex CLI 0.142.4 (GPT-5.5).

## How do I fix it?

Do not run untrusted repositories through coding agents in autonomous or auto-approve modes that can execute commands and reach secrets.

## How do I find every machine running Claude Code CLI?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Claude Code CLI and which version, then enforce a policy on it.

## References

- article: https://thehackernews.com/2026/07/friendly-fire-ai-agents-built-to-catch.html

## Related vulnerabilities

- [manus-one-email-with-a-jsfuck-payload-or-one-shared-project-instruction](https://catalog.anomity.ai/vuln/manus-one-email-with-a-jsfuck-payload-or-one-shared-project-instruction) — high
- [prompt-injection-is-not-the-bug-check-point-discloses-11-flaws-inside](https://catalog.anomity.ai/vuln/prompt-injection-is-not-the-bug-check-point-discloses-11-flaws-inside) — high
- [CVE-2026-50548](https://catalog.anomity.ai/vuln/cve-2026-50548) — critical
- [google-patches-antigravity-ide-prompt-injection-sandbox-escape](https://catalog.anomity.ai/vuln/google-patches-antigravity-ide-prompt-injection-sandbox-escape) — high
- [CVE-2026-115726](https://catalog.anomity.ai/vuln/cve-2026-115726) — high
- [CVE-2026-103572](https://catalog.anomity.ai/vuln/cve-2026-103572) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=friendly-fire-claude-code-and-codex-driven-to-rce-from-untrusted-repos