Answer Brief
The Friendly Fire proof-of-concept demonstrates how attackers can weaponize AI coding agents through prompt injection in project documentation, achieving remote code execution by exploiting the agent's inability to distinguish between data and executable instructions without modifying the agent itself.
Signal Timeline
A quick visual path for analysts before reading the full brief.
- 1
AI Now Institute releases Friendly Fire PoC research
- 2
TWCERT/CC publishes advisory on Friendly Fire attack
Executive Summary: The Friendly Fire proof-of-concept demonstrates how attackers can weaponize AI coding agents through prompt injection in project documentation, achieving remote code execution by exploiting the agent's inability to distinguish between data and executable instructions without modifying the agent itself.
Why It Matters
The Friendly Fire attack represents a significant evolution in prompt injection techniques by shifting the attack surface from direct model interaction to the autonomous tool-use behaviors of AI coding agents. Rather than attempting to jailbreak the language model through adversarial inputs, attackers exploit the agent's programmed tendency to interpret and act upon natural language instructions found in project documentation. This approach is particularly insidious because it leverages trusted files—README.md, CLAUDE.md, and similar guides—that agents are explicitly designed to read during repository analysis to inform their security assessments and operational decisions. The attack's two-stage nature—planting a malicious binary disguised as a security tool (e.g., security.sh) and then placing contextual prompts in documentation to induce its execution—reveals a critical flaw in how AI agents establish trust boundaries between analytical data and actionable commands. This vulnerability is not model-specific; successful demonstrations across multiple Claude and GPT versions indicate a systemic issue in current agent architectures that integrate large language models with external tool invocation capabilities. The research underscores that even without modifying the agent's configuration, model weights, or safety filters, attackers can achieve remote code execution by manipulating the agent's decision-making process through environmental cues in the software supply chain. The insufficiency of conventional defenses like sandboxing and manual approval is further highlighted by historical vulnerabilities in Claude Code (CVE-2026-39861 and CVE-2026-25725), which demonstrate that isolation mechanisms can be circumvented due to implementation flaws or misconfigurations. Moreover, reliance on per-action user approval introduces psychological vulnerabilities such as consent fatigue, where frequent prompts lead to diminished scrutiny over time, effectively negating the security value of human-in-the-loop designs. TWCERT/CC's five-point mitigation framework addresses these layers: isolating untrusted content prevents the initial injection, least privilege limits blast radius, tool restriction reduces attack surface, provenance verification blocks unauthorized binaries, and behavioral monitoring enables post-exploitation detection. However, implementing these controls requires careful balance—overly restrictive tool policies may hinder legitimate development workflows, while provenance checks depend on robust signing and verification infrastructure that many teams lack. The attack also raises broader questions about the fundamental design of AI agents in security roles: if tools meant to defend systems can be turned against them through documentation manipulation, then trust in automated security processes must be reevaluated. Organizations should verify whether their AI agents automatically ingest and act upon external documentation, assess the privilege levels granted to these agents during code analysis, and monitor for anomalous patterns such as unexpected script executions or network connections following documentation parsing. Future research should explore architectural solutions like strict data-instruction separation, runtime intent verification, and policy-based tool governance that can distinguish between legitimate security checks and attacker-induced actions without breaking developer experience.
Event Type: security
Importance: high
Affected Companies
- AI Now Institute
- TWCERT/CC
Affected Sectors
- artificial intelligence
- cybersecurity
- software development
Key Numbers
- PoC release date: 2026-07-08
- TWCERT/CC advisory date: 2026-07-29
Timeline
- AI Now Institute releases Friendly Fire PoC research
- TWCERT/CC publishes advisory on Friendly Fire attack
Frequently Asked Questions
What is the Friendly Fire attack and how does it work?
The Friendly Fire attack is a proof-of-concept technique where attackers place malicious code in a software repository and add misleading instructions in documentation files like README.md or CLAUDE.md. These prompts trick AI agents into believing the malicious file is a legitimate security tool, causing the agent to execute it and achieve remote code execution without altering the agent’s configuration.
Which AI models are vulnerable to the Friendly Fire attack?
The Friendly Fire attack has been demonstrated to work across multiple versions of Claude and GPT models. The exploit does not require significant model-specific modifications, indicating a broad architectural vulnerability in AI agents that process natural language prompts and execute tools based on them.
Why are sandboxing and manual review insufficient defenses against Friendly Fire?
Sandboxing can be bypassed via known flaws like CVE-2026-39861 and CVE-2026-25725, which allow escape or persistence. Manual review is undermined by 'consent fatigue'—users become desensitized to frequent approval prompts and stop scrutinizing commands, weakening human oversight as a reliable control.
What mitigations does TWCERT/CC recommend for the Friendly Fire attack?
TWCERT/CC recommends five mitigations: (1) separating untrusted content from agent instructions, (2) applying least privilege and isolating sensitive environments, (3) restricting which tools and commands the agent can invoke, (4) implementing pre-execution checks and file provenance verification, and (5) monitoring agent behavior with multi-layered isolation.
How does the Friendly Fire attack differ from traditional prompt injection?
Unlike direct prompt injection that targets the AI model's input, Friendly Fire injects malicious prompts into trusted project documentation that AI agents autonomously read during analysis. This indirect approach exploits the agent's tool-use behavior rather than its language understanding, making it harder to detect via conventional input filtering.