Friendly Fire and GhostApproval are the names Blurtek uses for two real attack patterns against AI coding agents (Claude Code, Cursor, Copilot): hidden instruction injection in rules files, PR comments, or issues that the agent reads as trusted context, causing it to approve, merge, or execute malicious code without the human reviewer noticing.
What these attacks actually are (and aren't)
Neither Friendly Fire nor GhostApproval is an official CVE: they describe a pattern built on the 'Rules File Backdoor' technique documented by security researchers in 2025, which hides invisible instructions inside rules files like .cursorrules. What changes with coding agents is the permission level: they can write, commit, and in aggressive setups, merge directly into the production repository.
Friendly Fire: the agent becomes the vector
The agent, acting with legitimate credentials, executes poisoned instructions hidden inside the repository itself: rules files, README, or past commits. The weapon and the authorization were legitimate; only the order was poisoned.
GhostApproval: the approval nobody gave
When the manipulated agent issues an automatic approval, it gets logged with the same weight as a real human review, without any real judgment behind it.
What your development team should watch
- Audit your agents' rules files like production code
- Disable auto-merge on protected branches; require a human checkpoint
- Treat any external PR as untrusted content for the agent too
- Limit which tools the agent can invoke during a review
If your team already runs coding agents with write access to the repository, Blurtek reviews the permission setup and approval flow before it becomes an incident.
Solicitar diagnóstico