AI coding agents exploited to run malware via README instructions, researchers find

Researchers at the AI Now Institute published a proof-of-concept attack called 'Friendly Fire' on July 9, showing that AI coding agents like Claude Code can be tricked into executing malicious scripts by embedding instructions in a repository's README file. Because autonomous agents follow task-consistent instructions without evaluating intent, a simple line directing the agent to run a 'security checker' before a pull request was enough to trigger a hidden malware payload. A separate disclosure, 'GitLost' by Noma Security on July 7, demonstrated a related flaw where an agent could be manipulated into leaking private repository contents into public comments. Neither attack exploits a software vulnerability or stolen credential — both rely entirely on the agent's core design of faithfully executing instructions found in its working context. The findings highlight a fundamental architectural gap in agentic AI systems, which currently lack a suspicion or intent-evaluation layer that humans naturally apply when reading instructions.