RESEARCHERS have raised concerns about the security implications of AI tools like Anthropic's Claude Code and OpenAI's Codex, which are designed to automate vulnerability discovery and patch management. A report from the AI Now Institute highlights a proof-of-concept exploit that could allow remote code execution through malicious instructions hidden in open-source code.
The exploit takes advantage of the AI's ability to execute commands without human oversight, misleading it into running harmful code masked as legitimate tasks. This vulnerability underscores broader architectural risks associated with granting AI agents autonomy in security applications, raising questions about their safe deployment in critical systems.