{"id":18381,"date":"2026-07-24T03:56:10","date_gmt":"2026-07-24T03:56:10","guid":{"rendered":"https:\/\/8657085.xyz\/?p=18381"},"modified":"2026-07-24T03:56:10","modified_gmt":"2026-07-24T03:56:10","slug":"ai-security-tools-can-be-manipulated-into-running-malware-researchers-warn","status":"publish","type":"post","link":"https:\/\/8657085.xyz\/?p=18381","title":{"rendered":"AI security tools can be manipulated into running malware, researchers warn"},"content":{"rendered":"<p> <div style=\"display: grid; grid-template-columns: 300px 160px; gap: 2px; width: 460px; background: #eee; padding: 2px;\">\r\n\r\n  <!-- \u6574\u884c\u5bbd\u5e7f\u544a -->\r\n  <div style=\"grid-column: 1\/-1; width: 460px; height: 250px; background: #ccc; display: grid; place-items: center;\">\r\n  <script async type=\"application\/javascript\" src=\"https:\/\/a.magsrv.com\/ad-provider.js\"><\/script> \r\n <ins class=\"eas6a97888e2\" data-zoneid=\"5876674\"><\/ins> \r\n <script>(AdProvider = window.AdProvider || []).push({\"serve\": {}});<\/script>\r\n  <\/div>\r\n  <div style=\"grid-column: 1\/-1; width: 460px; height: 90px; background: #ccc; display: grid; place-items: center;\">\r\n  <script async type=\"application\/javascript\" src=\"https:\/\/a.magsrv.com\/ad-provider.js\"><\/script> \r\n <ins class=\"eas6a97888e2\" data-zoneid=\"5876676\"><\/ins> \r\n <script>(AdProvider = window.AdProvider || []).push({\"serve\": {}});<\/script>\r\n  <\/div>\r\n\r\n  <!-- \u5de6\u4fa7\u7ad6\u6392 -->\r\n  <div style=\"height: 250px; background: #ccc; display: grid; place-items: center;\">\r\n  <script async type=\"application\/javascript\" src=\"https:\/\/a.magsrv.com\/ad-provider.js\"><\/script> \r\n <ins class=\"eas6a97888e2\" data-zoneid=\"5876672\"><\/ins> \r\n <script>(AdProvider = window.AdProvider || []).push({\"serve\": {}});<\/script>\r\n  <\/div>\r\n  <div style=\"height: 500px; background: #ccc; display: grid; place-items: center;\">\r\n  <script async type=\"application\/javascript\" src=\"https:\/\/a.magsrv.com\/ad-provider.js\"><\/script> \r\n <ins class=\"eas6a97888e2\" data-zoneid=\"5876680\"><\/ins> \r\n <script>(AdProvider = window.AdProvider || []).push({\"serve\": {}});<\/script>\r\n  <\/div>\r\n\r\n  <!-- \u53f3\u4fa7\u6469\u5929\u697c\uff08\u548c\u5de6\u4fa7\u5b8c\u5168\u5bf9\u9f50\uff09 -->\r\n  <div style=\"grid-row: 3\/5; height: 750px; background: #ccc; display: grid; place-items: center;\">\r\n  <script async type=\"application\/javascript\" src=\"https:\/\/a.magsrv.com\/ad-provider.js\"><\/script> \r\n <ins class=\"eas6a97888e2\" data-zoneid=\"5876678\"><\/ins> \r\n <script>(AdProvider = window.AdProvider || []).push({\"serve\": {}});<\/script>\r\n  <\/div>\r\n  \r\n  <script async type=\"application\/javascript\" src=\"https:\/\/a.magsrv.com\/ad-provider.js\"><\/script> \r\n <ins class=\"eas6a97888e6\" data-zoneid=\"5876682\"><\/ins> \r\n <script>(AdProvider = window.AdProvider || []).push({\"serve\": {}});<\/script>\r\n<\/div><br \/>\n<\/p>\n<div style=\"padding-right:0;padding-left:0\">\n<p class=\"wp-block-paragraph\">A new proof-of-concept attack dubbed <strong>\u201c<\/strong><strong>Friendly Fire<\/strong><strong>\u201d<\/strong> is raising concerns about the growing use of autonomous artificial intelligence agents in cybersecurity workflows. The research demonstrates how AI-powered coding assistants designed to identify security flaws can instead be manipulated into executing malicious code, effectively turning a defensive tool into an attack vector.<\/p>\n<p class=\"wp-block-paragraph\">The exploit, developed by researchers at the AI Now Institute, targeted Anthropic\u2019s Claude Code and OpenAI\u2019s Codex operating in their autonomous modes. The attack required neither elevated privileges nor specialized configuration changes. Instead, the researchers embedded instructions within a seemingly benign README file inside a software repository and then asked the AI agent to perform a routine security review. The result was the execution of a hidden malicious binary.<\/p>\n<p class=\"wp-block-paragraph\">According to the researchers, the attack works because AI agents frequently treat all text within their context window as equally authoritative. In practical terms, a developer\u2019s instruction and text embedded within third-party software documentation can appear indistinguishable to the model.<\/p>\n<h2 id=\"h-a-familiar-problem-with-a-new-twist\" class=\"wp-block-heading\"><strong>A familiar problem with a new twist<\/strong><\/h2>\n<p class=\"wp-block-paragraph\">The Friendly Fire attack is part of a broader category of vulnerabilities known as <strong>prompt injection attacks<\/strong>, where malicious instructions are concealed within content that an AI system is asked to process. The researchers demonstrated that a simple request such as \u201cperform security testing on this project\u201d was sufficient to trigger the chain of events. The AI agent read the repository documentation, interpreted instructions within the README as legitimate, and executed a hidden script.<\/p>\n<p class=\"wp-block-paragraph\">To illustrate the concept, the researchers modified a copy of the open-source Python geocoding library <strong>geopy<\/strong>, inserting a malicious binary alongside a decoy source file designed to make the binary appear legitimate. The README then encouraged the execution of a security-checking script. From the AI agent\u2019s perspective, running the script appeared to be an appropriate step in the requested analysis.<\/p>\n<p class=\"wp-block-paragraph\">Importantly, the researchers emphasized that the issue is not tied to a specific software version. Rather, they argue the weakness stems from how contemporary large language models process information and make decisions.<\/p>\n<p class=\"wp-block-paragraph\">Commenting on the findings to <em>Digital Journal<\/em>, Eljan Mahammadli, Head of AI Provenance at Polygraf AI, says the significance lies less in the specific exploit and more in the underlying architectural limitation that it reveals. \u201cThe important part of AI Now\u2019s Friendly Fire research is the weakness it exposes, rather than the specific binary or poisoned README the researchers used to demonstrate it,\u201d Mahammadli explains.<\/p>\n<p class=\"wp-block-paragraph\">According to Mahammadli, AI models currently lack a dependable mechanism for distinguishing between trusted instructions issued by a user and untrusted content obtained from external sources. Everything is processed as a stream of tokens, meaning repository documentation can carry the same apparent authority as developer instructions<\/p>\n<p class=\"wp-block-paragraph\">This helps explain why similar attack techniques continue to emerge through various channels. Mahammadli points to examples such as Adversa\u2019s TrustFall research and Tenet\u2019s Agentjacking demonstrations, both of which relied on hidden instructions designed to manipulate AI agents. The common theme is that AI systems struggle to determine who authored a piece of information and whether that information should be trusted.<\/p>\n<p class=\"wp-block-paragraph\">\u201cIn provenance terms, this is a failure of attribution,\u201d Mahammadli notes. \u201cThe agent acts on text without any dependable sense of where it came from or whether that source should be trusted.\u201d<\/p>\n<p class=\"wp-block-paragraph\">Despite the alarming nature of the findings, Mahammadli cautions against interpreting the research as evidence that AI should not be used for cybersecurity. Instead, he argues that the problem originates from a specific deployment architecture that has become increasingly common: agents that can simultaneously read untrusted content, execute commands, and access sensitive systems, with only a safety classifier standing between them and potentially dangerous actions.<\/p>\n<p class=\"wp-block-paragraph\">\u201cWhen those powers sit together, a single injected instruction is enough to turn the agent against its operator,\u201d he says.<\/p>\n<p class=\"wp-block-paragraph\">The solution, he suggests, lies in runtime security controls rather than relying solely on model improvements. Security systems should be capable of identifying externally sourced instructions and preventing them from escalating into executable actions. Sandboxing can also play a role, although Mahammadli warns that sandboxing alone should not be viewed as a complete solution.<\/p>\n<p class=\"wp-block-paragraph\">Perhaps the most interesting aspect of the Friendly Fire research concerns the behaviour of advanced models themselves. The researchers observed that some newer models appeared capable of recognizing inconsistencies between the malicious binary and its purported source code origin. Yet despite detecting the mismatch, the models proceeded with execution anyway. \u00a0This finding challenges a widely held assumption in the AI industry, that more capable systems are inherently safer systems.<\/p>\n<p class=\"wp-block-paragraph\">Instead, the research suggests that increasing capability without improving trust evaluation may simply create more efficient executors of instructions, regardless of who authored those instructions. A highly capable agent may therefore become more dangerous if it lacks reliable methods for establishing the provenance and trustworthiness of information.<\/p>\n<\/div>\n<p><!-- \u603b\u5bb9\u5668\uff1a\u6700\u5927\u5bbd908px Grid\u7d27\u51d1\u5e03\u5c40 -->\r\n<div style=\"display: grid; grid-template-columns: 728px 160px; gap:2px; width:908px; background:#eee; padding:2px;\">\r\n\r\n  <!-- \u901a\u680f\u9876\u90e8\uff1a\u6700\u5927\u6a2a\u5e45 908x258 \u8de8\u6574\u884c -->\r\n  <div style=\"grid-column:1\/-1; height:258px; background:#ff6b6b; display:grid; place-items:center;\">\r\n    <!-- JuicyAds v3.0 -->\r\n<script type=\"text\/javascript\" data-cfasync=\"false\" async src=\"https:\/\/poweredby.jads.co\/js\/jads.js\"><\/script>\r\n<ins id=\"1114307\" data-width=\"908\" data-height=\"258\"><\/ins>\r\n<script type=\"text\/javascript\" data-cfasync=\"false\" async>(adsbyjuicy = window.adsbyjuicy || []).push({'adzone':1114307});<\/script>\r\n<!--JuicyAds END-->\r\n  <\/div>\r\n\r\n  <!-- \u7b2c\u4e8c\u901a\u680f\uff1a728\u00d790 \u901a\u680f -->\r\n  <div style=\"grid-column:1\/-1; height:90px; background:#4ecdc4; display:grid; place-items:center;\">\r\n    <!-- JuicyAds v3.0 -->\r\n<script type=\"text\/javascript\" data-cfasync=\"false\" async src=\"https:\/\/poweredby.jads.co\/js\/jads.js\"><\/script>\r\n<ins id=\"1114300\" data-width=\"728\" data-height=\"90\"><\/ins>\r\n<script type=\"text\/javascript\" data-cfasync=\"false\" async>(adsbyjuicy = window.adsbyjuicy || []).push({'adzone':1114300});<\/script>\r\n<!--JuicyAds END-->\r\n  <\/div>\r\n\r\n  <!-- \u5de6\u4fa7\u4e3b\u680f\uff1a\u591a\u5e7f\u544a\u5806\u53e0 -->\r\n  <div style=\"display:grid; gap:2px;\">\r\n    <div style=\"height:60px; background:#45b7d1; display:grid; place-items:center;\">\r\n\t<!-- JuicyAds v3.0 -->\r\n<script type=\"text\/javascript\" data-cfasync=\"false\" async src=\"https:\/\/poweredby.jads.co\/js\/jads.js\"><\/script>\r\n<ins id=\"1114308\" data-width=\"468\" data-height=\"60\"><\/ins>\r\n<script type=\"text\/javascript\" data-cfasync=\"false\" async>(adsbyjuicy = window.adsbyjuicy || []).push({'adzone':1114308});<\/script>\r\n<!--JuicyAds END-->\r\n\t<\/div>\r\n    <div style=\"height:250px; background:#ffe066; display:grid; place-items:center;\">\r\n\t<!-- JuicyAds v3.0 -->\r\n<script type=\"text\/javascript\" data-cfasync=\"false\" async src=\"https:\/\/poweredby.jads.co\/js\/jads.js\"><\/script>\r\n<ins id=\"1114299\" data-width=\"300\" data-height=\"250\"><\/ins>\r\n<script type=\"text\/javascript\" data-cfasync=\"false\" async>(adsbyjuicy = window.adsbyjuicy || []).push({'adzone':1114299});<\/script>\r\n<!--JuicyAds END-->\r\n\t<\/div>\r\n    <div style=\"height:250px; background:#ff9ecd; display:grid; place-items:center;\">\r\n\t<!-- JuicyAds v3.0 -->\r\n<script type=\"text\/javascript\" data-cfasync=\"false\" async src=\"https:\/\/poweredby.jads.co\/js\/jads.js\"><\/script>\r\n<ins id=\"1114305\" data-width=\"250\" data-height=\"250\"><\/ins>\r\n<script type=\"text\/javascript\" data-cfasync=\"false\" async>(adsbyjuicy = window.adsbyjuicy || []).push({'adzone':1114305});<\/script>\r\n<!--JuicyAds END-->\r\n\t<\/div>\r\n    <div style=\"height:139px; background:#c792ea; display:grid; place-items:center;\">\r\n\t<!-- JuicyAds v3.0 -->\r\n<script type=\"text\/javascript\" data-cfasync=\"false\" async src=\"https:\/\/poweredby.jads.co\/js\/jads.js\"><\/script>\r\n<ins id=\"1114302\" data-width=\"133\" data-height=\"139\"><\/ins>\r\n<script type=\"text\/javascript\" data-cfasync=\"false\" async>(adsbyjuicy = window.adsbyjuicy || []).push({'adzone':1114302});<\/script>\r\n<!--JuicyAds END-->\r\n\t<\/div>\r\n    <div style=\"height:125px; background:#91e7ac; display:grid; place-items:center;\">\r\n\t\r\n<!-- JuicyAds v3.0 -->\r\n<script type=\"text\/javascript\" data-cfasync=\"false\" async src=\"https:\/\/poweredby.jads.co\/js\/jads.js\"><\/script>\r\n<ins id=\"1114303\" data-width=\"125\" data-height=\"125\"><\/ins>\r\n<script type=\"text\/javascript\" data-cfasync=\"false\" async>(adsbyjuicy = window.adsbyjuicy || []).push({'adzone':1114303});<\/script>\r\n<!--JuicyAds END-->\r\n\t<\/div>\r\n  <\/div>\r\n\r\n  <!-- \u53f3\u4fa7\u7ad6\u680f\uff1a160\u00d7600 \u6574\u5217\u9ad8\u5e7f\u544a -->\r\n  <div style=\"grid-row:3\/8; height:600px;  display:grid; place-items:center;\">\r\n    <!-- JuicyAds v3.0 -->\r\n<script type=\"text\/javascript\" data-cfasync=\"false\" async src=\"https:\/\/poweredby.jads.co\/js\/jads.js\"><\/script>\r\n<ins id=\"1114301\" data-width=\"160\" data-height=\"600\"><\/ins>\r\n<script type=\"text\/javascript\" data-cfasync=\"false\" async>(adsbyjuicy = window.adsbyjuicy || []).push({'adzone':1114301});<\/script>\r\n<!--JuicyAds END-->\r\n  <\/div>\r\n\r\n<\/div><br \/>\n<br \/> AI security tools can be manipulated into running malware, researchers warn<br \/>\n<br \/>#security #tools #manipulated #running #malware #researchers #warn<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A new proof-of-concept attack dubbed \u201cFriendly Fire\u201d is raising concerns about the growing use of&#8230;<\/p>\n","protected":false},"author":1,"featured_media":18382,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[14626,1371,4693,4134,354,3486,1011],"class_list":["post-18381","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-stories","tag-malware","tag-manipulated","tag-researchers","tag-running","tag-security","tag-tools","tag-warn"],"featured_image_urls":{"full":["https:\/\/8657085.xyz\/wp-content\/uploads\/2026\/07\/e2c272bbe87510fd7b3adb56b8df266525976092-1.jpg",768,512,false],"thumbnail":["https:\/\/8657085.xyz\/wp-content\/uploads\/2026\/07\/e2c272bbe87510fd7b3adb56b8df266525976092-1-150x150.jpg",150,150,true],"medium":["https:\/\/8657085.xyz\/wp-content\/uploads\/2026\/07\/e2c272bbe87510fd7b3adb56b8df266525976092-1-300x200.jpg",300,200,true],"medium_large":["https:\/\/8657085.xyz\/wp-content\/uploads\/2026\/07\/e2c272bbe87510fd7b3adb56b8df266525976092-1.jpg",640,427,false],"large":["https:\/\/8657085.xyz\/wp-content\/uploads\/2026\/07\/e2c272bbe87510fd7b3adb56b8df266525976092-1.jpg",640,427,false],"1536x1536":["https:\/\/8657085.xyz\/wp-content\/uploads\/2026\/07\/e2c272bbe87510fd7b3adb56b8df266525976092-1.jpg",768,512,false],"2048x2048":["https:\/\/8657085.xyz\/wp-content\/uploads\/2026\/07\/e2c272bbe87510fd7b3adb56b8df266525976092-1.jpg",768,512,false],"covernews-slider-full":["https:\/\/8657085.xyz\/wp-content\/uploads\/2026\/07\/e2c272bbe87510fd7b3adb56b8df266525976092-1.jpg",768,512,false],"covernews-slider-center":["https:\/\/8657085.xyz\/wp-content\/uploads\/2026\/07\/e2c272bbe87510fd7b3adb56b8df266525976092-1-768x500.jpg",768,500,true],"covernews-featured":["https:\/\/8657085.xyz\/wp-content\/uploads\/2026\/07\/e2c272bbe87510fd7b3adb56b8df266525976092-1.jpg",768,512,false],"covernews-medium":["https:\/\/8657085.xyz\/wp-content\/uploads\/2026\/07\/e2c272bbe87510fd7b3adb56b8df266525976092-1-540x340.jpg",540,340,true],"covernews-medium-square":["https:\/\/8657085.xyz\/wp-content\/uploads\/2026\/07\/e2c272bbe87510fd7b3adb56b8df266525976092-1-400x250.jpg",400,250,true]},"author_info":{"display_name":"admin","author_link":"https:\/\/8657085.xyz\/?author=1"},"category_info":"<a href=\"https:\/\/8657085.xyz\/?cat=7\" rel=\"category\">Stories<\/a>","tag_info":"Stories","comment_count":"0","_links":{"self":[{"href":"https:\/\/8657085.xyz\/index.php?rest_route=\/wp\/v2\/posts\/18381","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/8657085.xyz\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/8657085.xyz\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/8657085.xyz\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/8657085.xyz\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=18381"}],"version-history":[{"count":0,"href":"https:\/\/8657085.xyz\/index.php?rest_route=\/wp\/v2\/posts\/18381\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/8657085.xyz\/index.php?rest_route=\/wp\/v2\/media\/18382"}],"wp:attachment":[{"href":"https:\/\/8657085.xyz\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=18381"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/8657085.xyz\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=18381"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/8657085.xyz\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=18381"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}