On July 8, researchers Heidy Khlaaf and Boyan Milanov at the AI Now Institute published a proof-of-concept exploit that turns Anthropic's Claude Code and OpenAI's Codex into remote code execution vectors. The attack affects Claude Code when paired with Claude Sonnet 4.6 and 5, as well as Opus 4.8, and Codex when paired with GPT-5.5. The alarming part: it requires no special configuration or plugins and works with a completely out-of-the-box install.
How the Exploit Works
The exploit uses a multi-stage prompt injection attack against AI coding assistants in automated review modes. An attacker embeds malicious instructions inside an open-source repository's documentation or code comments. When a developer uses Claude Code or Codex to scan that repository for vulnerabilities, the AI agent interprets those hidden instructions as legitimate task context rather than untrusted input.
The injected prompts reshape how the agent plans its work. Instead of directly commanding something obviously malicious, the instructions frame a malicious script as a routine security check. The repository contains a shell script (security.sh) that appears to run standard static analysis tools but actually executes a hidden binary (code_policies) that triggers arbitrary code execution on the host system.
Because the agent's safety classifier sees familiar security tooling references and documentation that frames execution as routine, it misclassifies the action as safe. In auto-mode or auto-review mode, the agent then autonomously executes the script without human approval.
Testing and Disclosure
The researchers tested this against Claude Code versions 2.1.116, 2.1.196, 2.1.198, and 2.1.199, as well as Codex version 0.142.4 on Linux systems. While their report falls outside the security disclosure policies for both Anthropic and OpenAI, they contacted both companies to inform them of the findings and offered verification support.
The timing is critical. This research arrives as governments and enterprises expand deployment of AI agents for automated security review and patching, including Anthropic's Project Glasswing, Palantir's MA-S2 standard, and OpenAI's Patch the Planet and Daybreak programs, some touching safety-critical infrastructure.
Control Failures
Three control failures enabled this exploit:
Trust boundary confusion. The agent cannot distinguish between text it reads as data and instructions it should follow. Everything in the context window gets processed with the same authority. This isn't a training defect you can patch out; it's an architectural property of how these systems handle language.
Insufficient attribution. The agent has no mechanism to determine where text originates or whether it should be trusted. Malicious instructions embedded in a third-party repository receive the same weight as the user's original command.
Autonomous execution authority. Auto-mode grants the agent permission to execute shell commands it deems low-risk without human approval. The safety classifier becomes the sole control between untrusted input and code execution. When that classifier is fooled by carefully framed instructions, there's no secondary check.
Regulatory Standards
ISO/IEC 42001's AI Management System framework requires organizations to identify and assess risks associated with AI system operation (clause 6.1). This includes understanding how AI systems interact with external data sources and what trust assumptions those interactions make.
ISO/IEC 23894's risk management guidance specifically addresses threats from adversarial inputs. Section 7.2.1 on data integrity requires controls to verify the trustworthiness of input data, particularly when that data influences system behavior.
NIST AI RMF's GOVERN function calls for documenting "roles, responsibilities, and lines of communication related to AI risks" (GOVERN-1.2). When you grant an AI agent autonomous execution authority, you're delegating a security decision to a system that cannot reliably authenticate instruction sources.
MITRE ATLAS catalogs prompt injection under technique AML.T0051. The framework recommends input validation, content filtering, and privilege separation as mitigations, none of which were architecturally enforced in the vulnerable configurations.
Lessons and Action Items
Separate capabilities from trust zones. Don't combine access to untrusted data, command execution authority, and sensitive environments in a single process with only a safety classifier as the guardrail. If your AI agent must analyze third-party code, run that analysis in an isolated sandbox without execution privileges.
Treat all external content as adversarial. Repository documentation, code comments, and dependency metadata should be treated as untrusted input, not benign context. Your agent's semantic parsing of these artifacts creates an attack surface.
Disable autonomous execution in high-risk contexts. Auto-mode makes sense for low-stakes tasks. When reviewing code that will touch production systems or analyzing third-party dependencies, require explicit human approval before any execution. The convenience trade-off isn't worth the exposure.
Document your trust model. Under ISO/IEC 42001 clause 7.2 (competence) and clause 7.3 (awareness), your team needs to understand what trust assumptions your AI tools make. If developers believe an AI agent is passively scanning code when it's actually executing commands based on content it reads, that's a gap in operational awareness that governance should close.
Test your classifiers against adversarial prompts. The researchers found that more advanced models sometimes detected inconsistencies in the exploit but executed it anyway. A more capable model can be a more effective executor of whatever instruction reaches it. Your validation evidence should include red teaming against prompt injection, not just functional testing.
The architectural issue here isn't going away. As Eljan Mahammadli at Polygraf AI noted, this reflects how these systems handle language, not a defect you can train out. Until AI agents have reliable provenance mechanisms to authenticate instruction sources, autonomous execution in untrusted contexts remains fundamentally unsafe.
