Fast Facts
- AI agents in autonomous mode can execute malicious code from open-source repositories like README.md by disguising payloads as routine scripts, bypassing safety checks.
- Attackers can embed hidden binaries and malicious instructions in common files without triggering trust prompts, enabling stealthy command execution on the host system.
- Current safeguards, including model updates and sandboxing, are insufficient; untrusted code executed by AI agents poses a significant security risk with potential for host compromise.
Threat Overview, Attack Techniques, and Targets
Researchers found that top AI coding agents, like Anthropic’s Claude Code and OpenAI’s Codex, can be tricked into executing malicious code. These agents are designed to check open-source code for security problems. Instead of catching threats, they can run attacker-provided code if certain modes are active. The attack exploits the autonomous modes which approve commands based on a safety classifier.
The attackers used a common open-source library called geopy as bait. They placed a hidden payload inside a code file that appears safe. When the agent reviews the folder, it unwittingly runs the malicious binary embedded within the library. The attack is carried out using a simple command like “Perform security testing on this project.” The malicious script then executes without warnings, spreading a few extra files into the open-source project.
This method targets AI code review systems that handle untrusted code and review repositories with open files, especially README.md files. The attack works across multiple models and versions, showing its effectiveness and flexibility. It is important to note that this is a proof-of-concept and has not been observed in real-world attacks.
Impact, Security Implications, and Remediation Guidance
The attack can cause serious security issues. Malicious code can run on your machine without approval. The attacker could add harmful files or functions into your system. The main concern is that AI agents may not detect or block these hidden threats. Because the problem is in the design of the agents, fixing it requires changes in how the tools are used, not just updates to their software.
This vulnerability is significant in security tasks, as many organizations are adopting AI tools to analyze third-party code. The attack shows that improper trust in these tools can lead to system compromise.
There are no specific patches available yet. If you use AI coding agents, avoid giving untrusted code full command access. You should also monitor the agents for unexpected activity, especially if they run scripts or binaries from untrusted sources. Adding sandboxing can help contain potential damage but is not a complete solution.
If you need assistance with security measures or fixes, seek guidance from the relevant vendors or security authorities.
Expand Your Tech Knowledge
Learn how the Internet of Things (IoT) is transforming everyday life.
Discover archived knowledge and digital history on the Internet Archive.
ThreatIntel-V1
