Friendly Fire attack tricks AI coding agents into executing malicious code

The AI Now Institute published a proof-of-concept attack called 'Friendly Fire' that tricks Anthropic's Claude Code into running attacker code instead of just scanning for security holes. The exploit turns AI agents meant to catch malware into unwitting executors of malicious code.