Prompt-injected library reviews could make Claude Code or Codex run attacker commands: why it is not safe to use

What happened

On July 8, 2026, AI Now Institute published a policy brief called *Friendly Fire* describing a proof-of-concept attack on a common AI agent workflow: asking the agent to inspect an untrusted open-source project or third-party library. The researchers said an attacker could hide instructions inside the code or related data the model reads. In this context, prompt injection means untrusted content gives the AI hidden instructions that change its behavior. According to the brief, this could lead the agent to run commands on the host machine, a result known as remote code execution, which means software on one system causes commands to run on another. The researchers also said existing safety measures in large-scale AI agents did not stop the attack in their test.

What it means for you

If you use Claude Code or Codex to research outside code, review libraries, or inspect packages before installing them, this finding matters. Those normal tasks can become a path from reading untrusted content to executing commands. The risk is not simply "bad code" in a package. It is that the review process itself may expose the agent to attacker-written instructions.

What to do instead

Treat outside code and package reviews as higher risk. Avoid giving an AI agent broad permission to run shell commands while it reads untrusted repositories or libraries. Prefer a separate, limited environment for inspection, and review any proposed commands before approving them. Keep permissions as narrow as possible and avoid mixing casual research with access to important files or credentials. If you use AgentPod, note that it lists reviewed, tested skills, which can help reduce unnecessary exposure, but it does not remove the need for caution with untrusted code.

Sources:

• https://ainowinstitute.org/publications/friendly-fire-policy-brief