Friendly Fire tricks coding agents into running malware

AI Now Institute published a proof-of-concept July 9 that tricks a coding agent into running a hidden binary, per The Hacker News. Anyone running Claude Code CLI or OpenAI Codex CLI in autonomous or auto-review mode is exposed. That's two vendors and four models, Sonnet 4.6, Sonnet 5, Opus 4.8, and GPT-5.5, with no patch available.

The exploit, called Friendly Fire, disguises the payload as compiled Go code inside the geopy library. An agent in autonomous or auto-review mode reads the README's suggestion to run a "security script" and executes it. That's the whole attack: no phishing link, no social engineering beyond one plausible sentence in a text file.

It hits Claude Code CLI versions 2.1.116 through 2.1.199 and OpenAI Codex CLI 0.142.4, with no patch out. AI Now Institute is blunt about why: this isn't a bug in either CLI, it's what autonomous command approval is built to do. If an agent can run a command a README suggests, a hostile repo can suggest a bad one.

The fix nobody wants to ship

The real fix is a human approving every command an autonomous agent runs, which is the exact step these tools exist to remove. I'd bet vendors patch the geopy trick, maybe flagging disguised Go binaries or "security script" language in READMEs, before anyone touches the approval model itself. I'd also watch whether Claude Code or Codex change default auto-approve behavior, versus just detecting this one signature.