Your AI assistant is now a hacker: The Friendly Fire exploit is here

The Friendly Fire attack exploits the blind trust autonomous agents place in external documentation. When a developer points Claude Code or OpenAI Codex at a repository, these models scan the contents to understand the project structure. An attacker simply hides a malicious instruction inside a standard README.md file, masquerading it as a routine security check script.

Once the agent identifies the security.sh file as part of the auditing process, it executes the command without further human verification. The script then silently deploys a hidden binary directly onto the developer's machine. This isn't a bug in the code itself, but a fundamental flaw in the agent's permission model where execution rights are granted to untrusted external inputs.

Security researchers warn that simple patches won't fix this, as the core problem lies in the agent's ability to run shell commands autonomously. The vulnerability only triggers in 'auto-mode' or 'auto-review' settings, while manual confirmation blocks the exploit entirely. This follows a long line of similar issues like TrustFall and Agentjacking, proving that the AI-driven workflow is currently its own worst enemy.

Giving software the power to 'fix' itself is the ultimate tech-bro fantasy, but it turns out that when the code starts thinking, it also starts getting tricked by the most basic social engineering. It is truly peak Silicon Valley to build a tool meant to make us safer that ends up being the perfect delivery vehicle for malware just because we were too lazy to click 'Run' ourselves.

Source: AI Now Institute