Friendly Fire: Prompt Injection via Malicious Code Triggers Autonomous Execution in AI Security-Scanning Agents

Technical Analysis

The attack embeds instructions or exploit logic within the code sample being 'scanned', which the AI agent interprets as content to analyze but which instead manipulates the agent's reasoning or triggers legitimate-seeming tool calls (e.g., running a linter, test, or build step) that execute attacker-controlled code. The entry point is the untrusted code submitted for review, which crosses the trust boundary between 'data to be analyzed' and 'commands to be executed' once the agent operates in an autonomous, self-approving mode without human confirmation. The attacker gains arbitrary code execution on the machine running the agent, potentially leading to credential theft, lateral movement, or supply-chain compromise. This crosses agent/tool boundaries because the vulnerability lies in the agent's planner conflating analysis intent with execution intent, and its tool-use layer lacking sufficient isolation or sandboxing between reviewed content and executable actions.

Affected Systems

Claude Code, OpenAI Codex

Detection Signatures

• Agent logs showing shell/tool execution calls immediately following ingestion of externally-sourced code samples
• Execution of build/test/lint commands on files not explicitly requested by the user
• Unexpected outbound network calls or file writes originating from a 'code review' or 'scan' session
• Autonomous approval logs with no human-in-the-loop confirmation prior to code execution
• Code submissions containing embedded natural-language instructions directed at an AI reviewer (e.g., comments or strings resembling directives rather than functional code)

Remediation Steps

1. 1

   Disable full autonomous mode for code review tasks

   Require human-in-the-loop approval before any AI coding agent executes commands, scripts, or code originating from an untrusted or external source.

2. 2

   Sandbox execution environments

   Run any code analysis or execution triggered by AI agents inside isolated, ephemeral, network-restricted containers with no access to sensitive credentials or production systems.

3. 3

   Separate analysis from execution

   Architect agents so that 'read and analyze' operations are strictly separated from 'execute' capabilities, with distinct permission scopes and explicit gating between the two.

4. 4

   Input sanitization and prompt-injection filtering

   Scan submitted code for embedded natural-language instructions, suspicious comments, or strings designed to manipulate the agent before passing it to the model.

5. 5

   Least-privilege tool permissions

   Restrict the agent's available tools (shell, file write, network) during static analysis tasks so that even if manipulated, it cannot perform destructive or exfiltrating actions.

6. 6

   Audit and monitor autonomous approvals

   Log and review all self-approved actions taken by autonomous coding agents, with alerting on anomalous tool invocations during scanning workflows.