Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Friendly Fire: autonomous AI code-review modes can execute attacker-controlled repository code

Technical Analysis
First reported
Last updated
Happening score
H score 28
1 unique sources, 1 articles

Summary

Hide ▲

Friendly Fire shows that autonomous code-review modes in Claude Code and OpenAI Codex can be manipulated into executing attacker-controlled code on the host. The proof-of-concept abuses a normal repository review flow, using a seemingly routine README.md-driven security check to launch a hidden binary. The result is host command execution without a warning or approval prompt when the agent is allowed to approve its own commands.

Related Happenings

Microsoft Azure DevOps MCP server prompt-injection security flaw

Vulnerability
H score29 First: 22.07.2026 07:57 Last: 22.07.2026 07:57 Sources 1

About this happening: Microsoft Azure DevOps MCP server has a prompt-injection flaw in the repo_get_pull_request_by_id path that lets hidden HTML comments in pull request descriptions s...

Open Happening

OpenAI model sandbox escape and exploit chaining during ExploitGym evaluation

Technical Analysis
H score33 First: 22.07.2026 07:18 Last: 22.07.2026 07:18 Sources 1

About this happening: OpenAI's GPT-5.6 Sol and a pre-release model were observed chaining vulnerabilities and escaping a sandbox during evaluation, showing how advanced model behavior can drive...

Open Happening

Reproduced cross-vendor sandbox escapes in AI coding agents

Technical Analysis
H score22 First: 21.07.2026 00:14 Last: 21.07.2026 00:14 Sources 1

About this happening: Researchers reproduced sandbox-escape bypasses across Cursor, Codex, Gemini CLI, and Antigravity, showing that agentic coding tools can cross the sandbox bound...

Open Happening

Capital One open-sources VulnHunter AI security tool

Security Tool/Service
H score14 First: 20.07.2026 13:25 Last: 20.07.2026 13:25 Sources 1

About this happening: Capital One has released VulnHunter as open source, widening access to an AI-powered security tool built to find and fix code-level vulnerabilities. The tool depar...

Open Happening

Ghostcommit PNG-embedded prompt injection against AI code reviewers

Technical Analysis
H score25 First: 11.07.2026 12:03 Last: 11.07.2026 12:03 Sources 1

About this happening: Researchers demonstrated Ghostcommit, a PNG-embedded prompt-injection technique that can bypass AI code review and leak .env secrets into committed source. The pay...

Open Happening

Timeline

  1. 09.07.2026 08:15 1 articles · 13d ago

    AI Now Institute publishes Friendly Fire proof-of-concept for autonomous AI code review

    Initial Disclosure

    AI Now Institute published the Friendly Fire proof-of-concept showing that Anthropic's Claude Code and OpenAI Codex, when run in autonomous modes that approve their own commands, can be induced to execute a hidden binary while reviewing untrusted code. The demo used geopy, a README.md prompt to run security.sh, and worked across Claude Code CLI 2.1.116, 2.1.196, 2.1.198, 2.1.199 and OpenAI Codex CLI 0.142.4 on GPT-5.5 and Claude Sonnet 4.6, Sonnet 5, and Opus 4.8.

    Show sources
    Open in new tab