Friendly Fire attack tricks AI code scanners into running malicious code

AI Now Institute's proof-of-concept shows Claude Code can be tricked into executing attacker-controlled code. Dubbed "Friendly Fire," the attack exploits how agents handle code execution during security scans.