Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-07-30 · high
Claude Code CLI and Codex CLI 0.142.4 both fell to the same disguised-build-artifact payload, per AI Now Institute's Boyan Milanov and Heidy Khlaaf.
Why now: This demonstration surfaced in coverage dated July 30, when vendors pitch coding agents specifically as vulnerability reviewers, the exact job this exploit hijacks.
AI Now Institute researchers hijacked Claude Code and Codex, planting a hidden binary disguised as a build artifact next to a deceptive README.md. The attack ran mid-review, with the agent asked to scan code for vulnerabilities, per Boyan Milanov and Heidy Khlaaf.
That's the exact job these agents get pitched for: reviewing code nobody's vetted yet. Milanov and Khlaaf turned the reviewer into the execution vector.
The payload ran unmodified against Sonnet 5, Opus 4.8, and GPT-5.5, on both Claude Code CLI and Codex CLI 0.142.4. That's two competing products and three model generations, with zero edits between them.
There's no patch here. Milanov and Khlaaf's fix is behavioral: don't hand untrusted code to an agent that can run commands and reach your keys. Sandboxing is partial, and code inside one can still escape. Their write-up doesn't say whether either vendor has hardened its sandbox since.
I run Claude Code against other people's code in my own projects most weeks, so this lands close. Safety training in three separate model generations, from two competing labs, didn't stop any of it. Sandboxing was supposed to be the backstop. This demo shows it leaking.
Each link below shares sources, entities, or timing with this story.
AI Now Institute criticizes Claude Code / Shared entities / Same source / Shared topic / Earlier coverage
Linked by a graph relationship (AI Now Institute criticizes Claude Code); both cover AI Now Institute, Claude Code CLI, GPT, Opus; cite the same source (AI Now Institute researchers Boyan Milanov and Heidy Khlaaf).
AI Now Institute criticizes Claude Code / Shared entities / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (AI Now Institute criticizes Claude Code); both cover Claude Code, Codex, Codex CLI, GPT; overlapping topics (agent, claude, code, codex, coding).
Linked by a graph relationship (AI Now Institute criticizes Claude Code); both cover Claude Code, Codex, GPT, Sonnet; overlapping topics (against, agent, codex).
AI Now Institute criticizes Claude Code / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (AI Now Institute criticizes Claude Code); both cover Claude Code, Codex, Opus, Sonnet; overlapping topics (agent, claude, code, coding).
AI Now Institute criticizes Claude Code / Shared entities / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (AI Now Institute criticizes Claude Code); both cover Claude Code, Codex, Opus, Sonnet; overlapping topics (agent, claude, code, coding, command).
AI Now Institute criticizes Claude Code / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (AI Now Institute criticizes Claude Code); both cover Claude Code, Codex CLI, GPT, Opus; overlapping topics (agent, claude, code, codex, coding).
Linked by a graph relationship (AI Now Institute criticizes Claude Code); both cover Claude Code, Codex, GPT, Sonnet; overlapping topics (agent, claude, code, codex, coding).
Linked by a graph relationship (AI Now Institute criticizes Claude Code); both cover Claude Code, Codex, GPT, Opus; overlapping topics (agent, claude, code, codex).