The AI Now Institute recently published a proof-of-concept detailing a novel attack vector dubbed “Friendly Fire.” According to The Hacker News, this vulnerability targets AI-driven coding agents that are increasingly being deployed to audit open-source repositories for security flaws. While these agents are designed to improve security posture, the research demonstrates that they can be manipulated into executing the very malicious code they are meant to detect. This represents a significant Supply Chain Attack risk where the defense tool becomes the entry point for an adversary.
The core of the issue lies in how these agents process and interpret data found within a repository. When an agent like Anthropic’s Claude Code or OpenAI’s Codex is placed in an autonomous mode, it possesses the capability to suggest and execute shell commands to facilitate its scanning process. If an attacker seeds a repository with specially crafted instructions—essentially a form of indirect prompt injection—the agent may interpret these as legitimate operational requirements and execute them locally.
Exploiting Claude Code Autonomous Mode Security Risks
A primary concern for SOC teams is the erosion of the human-in-the-loop safeguard. When addressing Claude Code autonomous mode security risks, the researchers found that the agent could be tricked into approving its own commands. This bypasses the typical manual review process where a developer would verify a command before it runs. If the agent is instructed to “fix” a vulnerability or “run tests” on a compromised file, it may trigger an RCE event on the user’s machine.
This TTP leverages the inherent trust placed in the AI agent. Because the agent is acting on behalf of the user to improve security, the user may grant it broad permissions within the local environment. This creates a scenario where a Zero-Day vulnerability in the AI’s logic leads to a direct compromise. The exploitation is not limited to simple shell commands; it can involve complex multi-step processes where the agent is convinced that downloading and executing a remote script is necessary for its diagnostic tasks.
How to Detect Friendly Fire Exploit Attempts
Security professionals looking for how to detect Friendly Fire exploit attempts must focus on monitoring the behavior of AI agent processes. Since the AI agent often runs within a terminal or an integrated development environment (IDE), any unexpected child processes—such as curl commands to unknown C2 servers or unauthorized modifications to system configuration files—should be treated as high-fidelity IoC events.
Effective monitoring requires an EDR solution capable of tracking the lineage of commands executed by the AI’s runtime environment. If an agent starts performing Lateral Movement or attempts Privilege Escalation, it is likely that a Friendly Fire attack is in progress. Organizations should ingest these logs into a SIEM to correlate AI agent activity with known malicious patterns.
Mitigation and Defensive Recommendations
The most effective way of preventing AI agent command injection is to disable autonomous execution modes entirely. AI agents should operate in a read-only or suggestion-only capacity when dealing with untrusted third-party code. If autonomous execution is required for specific workflows, it must be performed within a strictly sandboxed environment—such as a transient container or a dedicated virtual machine with no access to sensitive local data or internal network resources.
Furthermore, implementing a Zero Trust architecture for development environments ensures that even if an AI agent is compromised, its ability to impact the broader infrastructure is limited. Developers should treat instructions generated by AI agents with the same level of scrutiny as code found in a Phishing email. Auditing the permissions granted to these tools and ensuring they follow the principle of least privilege is essential to maintaining a secure development lifecycle.
Related: AI CLI Tools Vulnerable to RCE via Malicious Repositories, CVE-2024-34351: ChromaDB RCE via MinJinja Template Injection