Prompt injection in third-party code could hijack Claude Code or Codex during a security scan: why it is not safe to use
A proof of concept showed that code in a third-party library could trick Claude Code or Codex into running harmful commands during scans.
What happened
A July 8, 2026 proof of concept from AI Now Institute, called Friendly Fire, showed a risk in AI coding tools during security reviews. According to Permission Protocol’s incident write-up, ordinary-looking files inside a third-party code library contained prompt injections, which are hidden instructions meant to steer an AI system. The write-up says this could target Claude Code and OpenAI Codex CLI while they scanned code for vulnerabilities.
Permission Protocol says the result could be attacker-chosen shell commands running on a developer laptop or a CI runner. A shell command is a text command that tells a computer to do something directly. The write-up says this could expose local credentials, environment variables, SSH keys, and other reachable secrets.
As of Permission Protocol’s July 10, 2026 timeline entry, it said there was no public patch or response from Anthropic or OpenAI at the time of indexing.
What it means for you
If you use an AI agent to review or scan code, be careful with third-party projects and dependencies. Even files that look normal may contain instructions that affect the agent’s behavior. For a regular user, the main risk is that an agent with broad local access could act on harmful instructions without clear warning.
What to do instead
Treat AI code scans as higher risk when they involve outside code. Run them in a locked-down environment, avoid giving the agent broad shell access, and keep secrets out of the machine or session where possible. Review any command before approving it if your tool allows that. Separate code review from machines that hold important keys or tokens.
If you use packaged tools or skills, prefer reviewed sources. AgentPod lists only reviewed, tested skills, which can help reduce risk, though it does not remove the need for caution.
Sources:
- https://www.permissionprotocol.com/agent-incident-tracker/ainowinstitute-friendly-fire-coding-agent-prompt-injection-rce
We report what our security review found at the time we checked, with the goal of keeping people safe. Projects change; if a maintainer has since fixed this, we are glad to recheck it. Email hello@agentpod.com.