The Security Reviewer Can Become the Entry Point

AI Now researchers Boyan Milanov and Heidy Khlaaf demonstrated what they call Friendly Fire: prompt injections in a third-party codebase led Claude Code and Codex configurations with autonomous command approval enabled to run attacker-controlled code during a security review. The finding is configuration-specific, not evidence that every interactive review is compromised. Its practical lesson is broader: untrusted repositories should be isolated, and automatic execution should not be treated as a neutral extension of code reading.