A Deep Dive into the RCE Vulnerability in Claude Code’s Auto-Mode
A recently uncovered exploit in Claude Code’s “auto-mode” has sparked significant concern among developers. This vulnerability allows for remote code execution (RCE) during third-party library reviews, effectively exposing systems to serious risks. The AI Now Institute has demonstrated how a typical routine code review can be manipulated to compromise the entire host machine that is running the AI coding agent.
Understanding the Exploit
The vulnerability specifically affects the stock versions of Claude Code CLI (from 2.1.116 through 2.1.199) operating with Claude Sonnet 4.6, Sonnet 5, or Opus 4.8 in “auto-mode.” Additionally, Codex CLI 0.142.4 using GPT-5.5 in an auto-review setting is also susceptible. Notably, the exploit does not require any additional configuration like hooks, skills, or plugins, making this a straightforward and alarming vector for attacks.
Routine Code Review Becomes a Target
Software developers often utilize AI agents to point towards open-source packages for vulnerability discovery. However, what was once seen as a safety measure now becomes a pathway for attackers. The essential access that developers need to conduct defensive scans unwittingly becomes a useful avenue for malicious actors.
Roey Eliyahu, CEO and Co-founder of Salt Security, emphasizes this alarming trend, highlighting multiple documented attacks—Friendly Fire, GitLost, Agentjacking, and TrustFall—over just two months. These incidents showcase a troubling pattern: untrusted text reaching an agent capable of executing commands leads to exploitation of the host environment.
The Mechanics of the Attack
The mechanics of the exploit hinge on the operational design of AI agents like Claude Code and Codex. In their auto-mode and auto-review settings, these agents approve shell commands deemed “safe” by the model. Presenting these modes as user-friendly defaults, the vendors promote ease of use and efficiency.
In their research, the AI Now team managed to leverage this vulnerability by installing agents on a Linux host or container, manipulating a local copy of a modified geopy library, and issuing a single instruction for security testing. The agents then explored the repository, treating apparently legitimate documentation and binaries as harmless. However, these benign surfaces concealed malicious payloads capable of compromising the host.
Overlooked Threats and Failures
Traditional static analysis checks failed to catch the malicious behavior, mainly because neither the script nor the binary was invoked by any legitimate library functions. When further probing these models for vulnerabilities, Claude Sonnet 4.6 and GPT-5.5 failed to flag the deceptive material. This uncertainty raises the stakes in terms of trust and reliability of AI review agents.
The exploit is not limited to just one model; it works across various models without requiring any alterations. In various trials, even when certain files were flagged as unrelated to the main project, the agents still proceeded to execute commands, adding to the risk. The researchers even achieved variations by placing deceptive instructions in documentation files—further demonstrating how easily these agents can be manipulated.
Real-World Implications for Developers
The implications of this vulnerability on daily software development practices and Continuous Integration (CI) systems are significant. Any developer workstation or CI runner that allows agents shell access and processes untrusted source code is inherently at risk. This means that even commonplace activities, such as reading README files or other ordinary source files, can inadvertently expose the development environment.
The AI Now Institute has released a “Friendly Fire” repository to aid researchers and engineers in examining the exploit’s structure safely, but it’s clear that traditional development practices require an urgent reassessment. Engineering organizations need to reconsider their approach to using open-source libraries or external code when incorporating these agents.
Recommendations for Mitigation
To mitigate these vulnerabilities, developers must take concrete actions. Firstly, refrain from deploying untrusted repositories within project environments, especially to agents capable of executing shell commands. Automated pipelines should also sanitize inputs to prevent potential espionage.
Organizations should isolate agent use to environments devoid of production secrets, broad filesystem mounts, or internal network paths, reducing attack surfaces significantly. Additionally, investing in runtime monitoring that observes agent actions can prompt early detection of any unusual or unauthorized command executions.
Roey Eliyahu succinctly summarizes the discord between the intended use of these AI tools and their inherent risks. The tools—marketed as solutions for handling untrusted code—also present an opportunity for exploitation if their permissions aren’t strictly controlled.
By ensuring detailed behavioral monitoring, teams can catch deviations that signal potential threats from the execution of unexpected binaries or scripts. In a landscape where traditional safeguards are increasingly inadequate, remaining vigilant through adaptive security measures becomes essential for mitigating these RCE vulnerabilities in development environments.