Defensive AI Exploit Targets Auto Mode Tools

A proof of concept shows defensive AI tools can be hijacked to execute remote code.

Researchers detailing the Friendly Fire exploit demonstrate a remote code execution path that appears when Claude Code CLI runs in auto-mode (and when OpenAI’s Codex CLI runs in auto-review). The attack relies on prompt injections distributed across a library’s source code, engineered to manipulate AI-enabled cyber defense without needing any hooks, plugins, MCP servers, or extra configuration files as an injection vector. In short, defenders using the very tools built to test security can be turned against themselves simply by how code or prompts are embedded in a project. The PoC specifically shows this behavior with Claude Sonnet 4.6 and 5, Opus 4.8, and GPT-5.5-based Codex CLI; the demonstrations include a video showing the technique in action. The broader takeaway is stark: automation in AI defense can become a vector if prompts and source code carry hidden instructions or prompts that trigger unintended behavior.

The attack vectors are subtle but potent. Prompt injections spread through a library’s codebase can steer the defensive agent to run hidden commands or bypass initial safeguards, all while keeping the operation within an auto-enabled defensive workflow. The researchers emphasize that the exploit does not require external configuration files or special access beyond the standard auto modes, which are designed to speed up security assessments. The result is a paradox: tools designed to strengthen security may, if misused or misconfigured, enable execution of code from within the very environment they are meant to protect. This is not a speculative warning. It directly tests defenses in widely used AI code assessment workflows and surfaces a tangible risk in real-world toolchains.

Context matters beyond the lab. The disclosure comes as policymakers push to accelerate AI-enabled defense capabilities. The White House released an executive order on June 2, 2026 titled Promoting Advanced Artificial Intelligence Innovation and Security, signaling a high-stakes push to grow AI defense tools while setting expectations for guardrails and risk management. In industry circles, pilot programs and standards efforts such as Palantir’s MA-S2 project have called for rapid deployment of AI-enabled defenses, sometimes without fully accounting for the safety implications of automated decision making in critical infrastructure. The tension between urgency to deploy stronger AI defenses and the need to manage residual risk is now front and center for compliance officers and tech executives.

For practitioners monitoring these developments, several concrete takeaways emerge. First, configurations that enable auto-mode or auto-review should be treated as high-risk deployment options, especially in safety-critical environments. Second, prompt hygiene and source-code vetting must extend to the libraries used by defensive AI tools, not just the code under direct review. Third, there is a clear need for stronger observability: comprehensive logging of prompts, model behavior, and outcomes to detect when auto workflows behave unexpectedly. Fourth, regulatory signals from the executive order and related standards indicate enforcement may tighten around how AI-enabled defenses are tested and deployed, even as speed to market remains a priority. In short, the incident underlines a core policy and governance question: how to keep auto-enabled AI defense both effective and safe when the same automation that speeds defense could be weaponized by prompt-level manipulation.

As defenders rush to scale AI-enabled protection, the message is precise: automation cannot outpace oversight. The PoC is a reminder that guardrails, including defaults, prompts, code provenance, and transparent telemetry, are now as essential as the tools themselves.