AI security tools from Anthropic, OpenAI pose attack vector risk
This digest was compiled by AI from multiple sources — links to the originals are below.
Researchers at the AI Now Institute demonstrated a proof-of-concept exploit targeting Anthropic's Claude Code and OpenAI's Codex, enabling remote code execution through prompt injection. The attack leverages the tools' auto-mode features to silently execute malicious commands when reviewing third-party codebases.
The Exploit Mechanism
The proof-of-concept, detailed in a July 8 report by Heidy Khlaaf and Boyan Milanov, exploits a multi-stage prompt injection chain combined with tool-use exploitation. An attacker embeds malicious instructions in open-source library files, such as code comments or documentation, designed to manipulate the AI's interpretation. When a victim uses Claude Code or Codex in auto-mode, the injected instructions trick the AI into executing commands without user approval.
Affected Versions and Scope
The exploit affects Claude Code with Claude Sonnet 4.6 and 5, as well as Opus 4.8, and Codex with GPT-5.5. The attack vector is triggered when the AI agent scans a repository, building a semantic model from source files. Injected instructions in trusted-looking artifacts like README.md reshape the agent's planning process, framing malicious scripts as part of a standard security workflow.
Second-Stage Payload
The repository contains a second-stage payload: a shell script (security.sh) that appears to run common tools, a hidden malicious binary (code_policies) executed by the script, and a decoy source file. The AI assistant is fooled into believing the commands are harmless, running them automatically without alerting the user.
What's Next
The AI Now Institute plans to release further technical details in a follow-up report. It remains unclear whether Anthropic or OpenAI will issue patches or modify auto-mode behavior in response.
1 source
AI security tools from Anthropic, OpenAI pose attack vector risk
