Vibe Coding
"Friendly Fire": One Unchanged Payload Hijacked Claude Code and Codex Across Three Model Generations
AI Now Institute researchers Boyan Milanov and Heidy Khlaaf demonstrated an attack that turns a coding agent doing vulnerability review into the execution vector, planting hidden binaries disguised as legitimate build artifacts alongside a deceptive README.md. The payload "worked unchanged on Sonnet 5, Opus 4.8, and GPT-5.5" against Claude Code CLI and Codex CLI 0.142.4 — no per-vendor tailoring. Their mitigation is blunt: do not hand untrusted code to an agent that can run commands and reach your keys, secrets, or host, because sandboxing is partial and "code running inside it can escape." Published July 9, 2026; still a lab proof-of-concept with no reported exploitation in the wild.
↳ Follow the thread