All posts
Scope Drift

Friendly Fire: Auto-Mode Coding Agents Run Attacker Code

AI Now Institute PoC shows Claude Code auto-mode and Codex auto-review can be steered from analyzing a repo to executing an attacker binary

Securityv0 Intelligence Team OWASP: ASI03 sv0 finding: scope_drift
claude-code codex scope-drift prompt-injection ai-coding-agents auto-mode

The Incident

On 2026-07-08, AI Now Institute researchers Boyan Milanov and Heidy Khlaaf published “Friendly Fire,” a proof-of-concept exploit that turns defensive coding agents into a vector for remote code execution during a security review. The exploit targets Anthropic Claude Code CLI in auto-mode (Claude Sonnet 4.6, Sonnet 5, Opus 4.8) and OpenAI Codex CLI in auto-review (GPT-5.5), out-of-the-box, without hooks, plugins, MCP servers, or config-file changes. The setup is a modified geopy library that ships a README.md prompt-injection layer describing security.sh as a routine defensive check; security.sh invokes code_policies, a payload binary disguised as the compiled output of a decoy code_policies.go file and seeded with strings from that decoy so the agent’s disassembly step ties the two together. A payload written for Sonnet 4.6 ran unchanged on Sonnet 5, Opus 4.8, and GPT-5.5. Milanov and Khlaaf notified Anthropic and OpenAI. No CVE has been assigned, no coordinated patch is scheduled, and no in-the-wild exploitation has been reported.

MITRE ATT&CK coverage: T1059 (Command and Scripting Interpreter), T1204.002 (User Execution: Malicious File).

The Authority Path That Failed

The identity that carried execution authority at the moment of failure was the auto-mode coding agent — Claude Code CLI or Codex CLI — running under the developer’s local shell identity. In auto-mode / auto-review, the operator hands the agent the developer’s full shell-execution scope, gated by a background classifier that decides per tool call whether to auto-approve or escalate to a human prompt. The scope the agent held was “run any command the classifier does not flag risky.” The scope the operator asked for was narrower: “review this untrusted third-party library.” The classifier was the trust anchor, and Anthropic publishes its two-stage classifier at a 0.4% false-positive rate and a 17% false-negative rate on the “overeager actions” test set — a gap wide enough to hide the exploit’s disassembly-check evasion.

The prompt-injected README.md described security.sh as a normal, defensive part of the library’s own tooling. The agent read that description as a workflow hint, invoked the script, and the script ran an unsigned binary from a repo the operator had asked it only to analyze. Anthropic and OpenAI have publicly declined to treat this as a security bug on the grounds that the agent stayed within its granted authority — which is precisely the authority-scope gap the exploit weaponizes.

SecurityV0 Perspective

This is scope_drift. Reviewing a repo is not the same as executing binaries from that repo, but auto-mode gives the agent no way to express or enforce the distinction; the classifier decides per call whether an action is “risky,” not whether it fits the operator’s original request. The evidence pack SecurityV0 would produce is job-scoped: given a review invocation of an auto-mode agent, list every shell tool call the agent made, group them by the artifact they touched, and flag any call that transitioned from reading the artifact under review to executing content sourced from it. The pre-exfiltration question the pack answers is “did the agent’s actions in this session stay inside the scope the operator described?” The post-exfiltration forensic question is “which tool call first crossed the read-to-execute boundary on the audited artifact, and what left the host after it did?”

What To Do

  • Disable auto-mode and auto-review for any job whose input is code from outside your trust boundary. For Claude Code CLI, require per-command approval — the interactive default — before pointing the agent at third-party repositories. Do the same for Codex CLI auto-review. Reserve auto-mode for repositories the operator authored or controls.
  • Instrument review jobs to capture every shell tool call the agent makes. Persist the argv, working directory, and the file or URL the agent was asked to review; alert when a tool call transitions from reading a path under the review artifact to executing content sourced from that path.
  • Treat classifier false-negatives as a design constant, not a bug. Anthropic publishes 17% false-negative on overeager actions; assume any classifier-only gate will fail on adversarial input and layer a second control — workflow-scope boundary, disposable sandbox, or human approval — around it before running the agent on untrusted code.
  • Segment the workstation host from developer credentials for review runs. Move code-review invocations into an ephemeral container or VM whose environment carries no long-lived non-human identities, developer SSH keys, or cloud tokens; nothing an agent can be steered into running should have access to the developer’s real identity.
  • Feed prompt-injection detection on the artifact under review, not just the operator prompt. README.md, install scripts, and any shell scripts shipped with an untrusted library must be treated as untrusted content that could carry instructions to the agent — scan them for imperative language about executing scripts before the agent processes them.

Sources

All posts