Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Prompt-injection proof-of-concept enables silent RCE in Claude Code and Codex

Technical Analysis
First reported
Last updated
Happening score
H score 28
1 unique sources, 1 articles

Summary

Hide ▲

Researchers demonstrated a proof-of-concept exploit that can force remote code execution in Anthropic’s Claude Code and OpenAI’s Codex, exposing a trust-boundary flaw in AI coding agents. The attack uses multi-stage prompt injection inside an untrusted repository to make attacker text look like normal task context. In auto-mode/auto-review, the agents can be pushed to run a supposed security.sh workflow that actually launches hidden code. The result is silent execution on a victim machine during a defensive scan.

Related Happenings

Microsoft Azure DevOps MCP server prompt-injection security flaw

Vulnerability
H score29 First: 22.07.2026 07:57 Last: 22.07.2026 07:57 Sources 1

About this happening: Microsoft Azure DevOps MCP server has a prompt-injection flaw in the repo_get_pull_request_by_id path that lets hidden HTML comments in pull request descriptions s...

Open Happening

Reproduced cross-vendor sandbox escapes in AI coding agents

Technical Analysis
H score22 First: 21.07.2026 00:14 Last: 21.07.2026 00:14 Sources 1

About this happening: Researchers reproduced sandbox-escape bypasses across Cursor, Codex, Gemini CLI, and Antigravity, showing that agentic coding tools can cross the sandbox bound...

Open Happening

Agent data injection proof-of-concept attacks expose trusted-data flaws in AI agents

Technical Analysis
H score25 First: 16.07.2026 14:32 Last: 16.07.2026 14:32 Sources 1

About this happening: Researchers disclosed agent data injection (ADI), a new attack class that can make shipping AI agents misclick, run attacker commands, and trust fake history across web and co...

Open Happening

Ghostcommit PNG-embedded prompt injection against AI code reviewers

Technical Analysis
H score25 First: 11.07.2026 12:03 Last: 11.07.2026 12:03 Sources 1

About this happening: Researchers demonstrated Ghostcommit, a PNG-embedded prompt-injection technique that can bypass AI code review and leak .env secrets into committed source. The pay...

Open Happening

Friendly Fire: autonomous AI code-review modes can execute attacker-controlled repository code

Technical Analysis
H score28 First: 09.07.2026 08:15 Last: 09.07.2026 08:15 Sources 1

About this happening: Friendly Fire shows that autonomous code-review modes in Claude Code and OpenAI Codex can be manipulated into executing attacker-controlled code on the host. The p...

Open Happening

Timeline

  1. 10.07.2026 16:45 2 articles · 13d ago

    AI Now Institute demonstrates prompt-injection remote code execution in Claude Code and Codex

    Initial Disclosure

    AI Now Institute researchers Heidy Khlaaf and Boyan Milanov published a July 8 proof-of-concept showing that multi-stage prompt injection hidden in a third-party open-source repository can steer Anthropic’s Claude Code and OpenAI’s Codex into running attacker-controlled commands on a victim machine. The exploit affects Claude Code with Claude Sonnet 4.6 and 5 and Opus 4.8, and Codex with GPT-5.5, by abusing auto-mode or auto-review to treat a malicious security.sh workflow as routine and launch a hidden code_policies binary, resulting in silent remote code execution.

    Show sources
    Open in new tab