Claude Code and Codex could be tricked by a booby-trapped library review: why it is not safe to use

What happened

On July 8, 2026, AI Now Institute published a proof of concept called Friendly Fire. It showed that Anthropic Claude Code and OpenAI Codex CLI could be pushed into remote code execution, which means code from an outside source could run on your machine, while they were only reviewing an untrusted third-party library.

The researchers said this worked in default setups, without extra add-ons or custom configuration. They reported successful tests against Claude Code CLI versions 2.1.116, 2.1.196, 2.1.198, and 2.1.199 in auto-mode, and Codex CLI version 0.142.4 in auto-review. The attack instructions were hidden across library files and documentation, including files such as CLAUDE.md or agent.md. A person asking for a normal security review could therefore trigger attacker instructions without realizing it.

What it means for you

If you use an AI coding agent to inspect code you did not write, treat that codebase as untrusted. Even a review task can carry risk if the agent is allowed to act automatically.

What to do instead

Turn off automatic action modes when reviewing unfamiliar libraries. Review in a more limited environment, and do not let the agent run commands just because a repository asks it to. Be cautious with instruction files and project documentation inside third-party codebases. If possible, inspect the library manually before asking an agent to do more. AgentPod lists only reviewed, tested skills, which can help reduce avoidable risk, but it is still wise to use least-access settings and careful review habits.

Sources:

• https://ainowinstitute.org/publications/friendly-fire-exploit-brief