The pitch for using AI coding assistants in security work is simple and appealing. Point the tool at an unfamiliar codebase, ask it to look for vulnerabilities, and let it do the tedious hunting a human would rather skip. A new proof-of-concept from the AI Now Institute shows that this exact workflow, the one defenders are told is safe, is also the attack.
Researchers Heidy Khlaaf and Boyan Milanov demonstrated remote code execution against two of the most widely used AI command-line tools, Anthropic's Claude Code and OpenAI's Codex. The setup needs no special plugins, hooks or configuration files; it works on an out-of-the-box install. An attacker hides instructions inside an ordinary-looking open-source project, tucked into a README or a code comment, and waits for someone to ask their AI assistant to scan the repository. The affected combinations span Claude Sonnet 4.6 and 5, Opus 4.8, and Codex running on GPT-5.5.
The trick is that the agent does not treat the text it reads as untrusted input. As it builds a picture of the project, it absorbs the planted instructions as part of its own task. Those instructions are crafted to frame a malicious script as a routine security check, something the model should run to complete the very analysis it was asked to perform. In the automatic modes that execute low-risk commands without pausing for approval, the agent obligingly runs the script, which launches a hidden binary, and the attacker's code is now executing on the victim's machine. The user believed they were passively scanning for bugs.
What makes the finding uncomfortable is that it is not really a bug to be patched. As one outside expert put it, an AI agent has no reliable way to tell the difference between the text it reads and the instructions it is meant to follow, because everything in its context window carries the same authority. That is a property of how these systems process language, not a defect you can train away. The attack surface is identical to the access the tool needs to do its legitimate job in the first place.
The timing is pointed. Governments and companies are racing to deploy these same tools for automated security review, through programs like Anthropic's Project Glasswing and OpenAI's Patch the Planet, some of which touch safety-critical infrastructure. The researchers argue their result undermines the premise that agents can be trusted with this work at all. Not everyone accepts that conclusion. One security researcher countered that the real fault is architectural sloppiness, combining untrusted data, command execution and sensitive access in a single process guarded only by a safety classifier, and that stronger runtime controls and separated capabilities could contain the risk.
There is a counterintuitive wrinkle worth sitting with. The researchers noticed that more capable models sometimes spotted the inconsistencies in the exploit and executed it anyway. A smarter, more compliant assistant, it turns out, can simply be a more efficient executor of whatever instruction happens to reach it. As the industry hands these agents more autonomy over what counts as safe to run, that is precisely the trait it will have to design around.