Mate in the Loopby Kenny Jung
KOEN

AI security · AI agent · LLMOther industries (software / AI coding agents)

Forever Security (Gal Weizman and Omer Samet, October 22) reports a live attack in which a website silently drops a malicious AGENTS.md or CLAUDE.md into ~/Downloads and any coding agent started there — OpenAI Codex or Claude Code — follows it as trusted instructions.

AI-drafted · reviewed by KennyCodex check · partly supported4 min read

Source [1] forever.security · 22 Oct 2026 · “Markdown Is the New Executable: Attackers Are Dropping Agent Instructions Into Your Downloads Folder From the Web” ↗
Adoption stage: Production — A named organisation runs it in day-to-day operations.

Summary

Forever Security (Gal Weizman and Omer Samet, October 22) reports a live attack in which a website silently drops a malicious AGENTS.md or CLAUDE.md into ~/Downloads and any coding agent started there — OpenAI Codex or Claude Code — follows it as trusted instructions. Against Codex the file registers a malicious MCP server in ~/.codex/config.toml that installs the known-malware npm package function-color, with over 90% success in testing; against Claude it redirects API traffic through ANTHROPIC_BASE_URL to an attacker domain for OAuth token theft and code execution, at about 50% initial compromise and about 20% same-session execution. The firm says there is nothing for OpenAI or Anthropic to patch and recommends never starting agents in Downloads, auditing instruction and config files, and keeping approval gates and sandboxes on.

Basis: the source [1], facts F1–F7

Kenny's take

What broke is not the model but the agent's design choice to trust the instruction file in its working folder, and the attacker used a 30-year-old browser capability to put the file there. Forever Security itself says there is nothing to patch. What is left is operating discipline: do not start agents in Downloads, audit config files, and leave approval gates and sandboxes on. This take weakens if OpenAI or Anthropic change how far agents trust instruction files at the product level.

AI draft · approved by Kenny

Analysis

What happened (vendor-reported, according to Forever Security): a live indirect prompt-injection attack on AI coding agents, published October 22, 2026. Who: developers running OpenAI Codex or Claude Code; the attacker is not named. Vector: a browser-dropped AGENTS.md or CLAUDE.md in ~/Downloads that the agent reads as project instructions. Impact as stated: for Codex, a persistent malicious MCP server that installs the function-color npm package, over 90% success in testing; for Claude, API traffic redirected via ANTHROPIC_BASE_URL leading to OAuth token theft and code execution, about 50% initial compromise and about 20% same-session execution. The source gives no count of affected organisations.

Control: stated in the source — do not start an agent in ~/Downloads, audit for unexpected instruction files, check ~/.codex/config.toml and .claude/settings.json for injected entries, and keep approval gates and sandboxes on rather than using bypass flags. The source's own position is that there is no vendor patch because the agent is behaving as designed.

For the pattern indirect-prompt-injection, the stage is set to production because, per the source, the attack ran against real deployed agents with real malware (function-color, since removed by npm), not in a lab. Nothing in the source touches ships, plants or grids, so it adds no direct evidence to q-agent-security-ot; it is a software-tooling incident.

Facts from the source

  1. F1According to Forever Security (authors Gal Weizman and Omer Samet, published October 22, 2026), it "identified a live attack where malicious markdown files (AGENTS.md or CLAUDE.md) planted in the ~/Downloads folder can manipulate AI coding agents (OpenAI Codex, Claude Code) into executing attacker commands". [1]
  2. F2The stated key risk: "Websites can silently drop files to Downloads without user interaction, and agents automatically trust and execute instructions from files in their working directory." [1]
  3. F3Against Codex, the planted file "tricks Codex into modifying ~/.codex/config.toml to register a malicious MCP server that installs the function-color npm package (known malware)"; success rate ">90% in testing"; the change "persists machine-wide across all future Codex sessions". [1]
  4. F4Against Claude, the attack "redirects Claude's API traffic via ANTHROPIC_BASE_URL environment variable to an attacker-controlled domain", resulting in OAuth token theft (account takeover) and arbitrary code execution via spoofed model responses; success "~50% for initial compromise; ~20% for same-session execution". [1]
  5. F5The function-color npm package is listed as the indicator of compromise, "removed by npm; real malware used in live attacks". [1]
  6. F6Quote: "There is nothing here for OpenAI or Anthropic to patch. An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do." [1]
  7. F7Recommended mitigations: never start Codex, Claude Code or any agent in ~/Downloads; audit for unexpected AGENTS.md or CLAUDE.md files; check ~/.codex/config.toml for unexpected [mcp_servers.*] blocks and project .claude/settings.json for unauthorised ANTHROPIC_BASE_URL entries; "Maintain approval gates and sandboxes; distrust bypass flags"; rotate credentials immediately if compromised. [1]

Organisations: Forever Security, OpenAI, Anthropic

Counterpoint — verification notes

Codex checked each sentence against the source and searched for counter-evidence. Verdict: Codex check · partly supported.

  • Other sideThe full article clarifies that the customer attempt was blocked before code ran, the file's arrival route was unknown, and the Claude Code attack was a separate test.
  • Other sideBleepingComputer independently verified a harmless download proof of concept, but says the real file's delivery route was undetermined; it also found browser notifications or approval prompts in some browsers. [2]
12 sentence-level checks
  • factspartly-supported: Forever Security identified a live attack involving malicious AGENTS.md or CLAUDE.md files against Codex or Claude Code. — The condensed source conflates the observed customer incident with later tests. The full article identifies one observed AGENTS.md attempt, stopped before code ran; the Claude Code variant was researcher-created and tested.
  • factspartly-supported: The Codex payload registers a malicious MCP server that installs function-color; testing succeeded more than 90% of the time and the configuration persists machine-wide. — The mechanism and figure match the source, but the test result is an unconfirmed vendor claim stated as fact in this bullet.
  • factspartly-supported: The Claude payload redirects API traffic through ANTHROPIC_BASE_URL, enabling token theft and code execution; test rates were about 50% and 20%. — These are Forever Security's unconfirmed tests, not an observed Claude Code incident; the bullet states the outcome without that attribution.
  • summary_enpartly-supported: A website silently dropped the file in the live attack, which involved either AGENTS.md or CLAUDE.md. — The delivery route in the customer incident was unknown. Only AGENTS.md was observed there; the CLAUDE.md path was tested afterward.
  • summary_enpartly-supported: Any coding agent started in Downloads follows the file as trusted instructions. — The source qualifies which agents are susceptible; it does not establish that every coding agent will follow the file.
  • summary_kopartly-supported: The live attack used website-dropped AGENTS.md and CLAUDE.md files to control both Codex and Claude Code. — The Korean summary makes the unknown delivery route and the separately tested Claude variant sound like observed parts of the live incident.
  • analysispartly-supported: The incident vector was a browser-dropped AGENTS.md or CLAUDE.md file. — Browser delivery was demonstrated in a test, not established for the observed customer incident; no CLAUDE.md was observed in that incident.
  • analysispartly-supported: The incident's impact included the stated Codex and Claude Code compromise outcomes. — The real attempt was blocked before code ran. The execution and token-theft outcomes and rates came from vendor tests.
  • analysisunsupported: The attack ran against real deployed agents with real malware, not in a lab, justifying production stage. — The observed attempt was stopped before code ran; the successful execution was a controlled test. No named organisation is identified as running this pattern in day-to-day operations.
  • takeunsupported: The attacker used a 30-year-old browser capability to place the file. — Both English and Korean takes present the demonstrated browser-delivery route as the known route of the real attack.
  • frontmatterpartly-supported: OpenAI and Anthropic are organisations involved in carrying out the reported incident. — They are named as the makers of the tested agents, not as the victim, attacker, or operator of the observed incident. The source title and publication date match.
  • stageproduction → research: The successful chains and rates are vendor tests. The single observed attempt was blocked, and the customer and attacker are unnamed; the taxonomy's production rule requires a named organisation running the pattern in day-to-day operations.

Sources

  1. [1] forever.security — “Markdown Is the New Executable: Attackers Are Dropping Agent Instructions Into Your Downloads Folder From the Web” original
  2. [2] bleepingcomputer.com counter-evidence (Codex)

Keep reading

Same industry

전기신문

At the Korean Society for Railway autumn conference on October 29, Lee Dong-seop of Daeati presented the AI train-conflict prediction and resolution system planned for the Second Railway Traffic Control Center (about KRW 250 billion, completion targeted for 2028).

It couples physics-based micro-simulation (gradient, curves, track length, vehicle specs) with AI trained on actual operating records and track occupancy, aiming to predict about 2 hours ahead and compute conflicts and resolution options in about 3 seconds; resolution runs reinforcement learning first, which handles about 995 of 1,000 cases, with a CP-SAT solver for the rest. The system presents conflict types and options and the dispatcher makes the final choice on punctuality, cost and energy; the Guro control center is to be upgraded to the same system for redundancy.

Other industriesAI / MLData science & classical MLStage · Research
Codex check · partly supportedRead the take
SecurityWeek

Cisco has open-sourced Project Quarry, a neurosymbolic rule language for detecting AI-agent attacks: rules combine neural evidence from ML classifiers and LLM judges with symbolic checks on conditions, sequences, string matches and tool relationships, across single- and multi-turn LLM conversations, agents, tool use, MCP interactions and multimodal inputs, for runtime guardrails, post-hoc analytics and incident response.

The article cites 2025 campaigns in which Claude Code was used against around 30 organisations and against Mexican government institutions, split into small routine-looking tasks. Cisco wants Quarry to become an open standard like Snort, YARA and Sigma, and points to Hugging Face reconstructing roughly 17,600 agent actions after the fact as the kind of sequence it aims to catch in progress.

Other industriesAI securityAI agentStage · Research
Codex check · partly supportedRead the take

Same AI technology

securitylabs.datadoghq.com

Datadog reports that release 1.107.0 of LiteLLM, a library with about 23 million weekly downloads, went out poisoned on PyPI and as Docker images tagged v1.107.0, latest, main-latest and main-stable.

The attackers ran LiteLLM's own private release workflow with GitHub CLI OAuth tokens stolen from three engineers, shipping a credential stealer that runs on every Python start plus a second-stage RAT backdoor. The PyPI release went live at 11:39 UTC, was quarantined at 13:20 UTC, and the Docker images were removed at 13:53 UTC — roughly two hours of exposure.

Other industriesAI securityLLMAI agentStage · Production
Codex check · partly supportedRead the take

Same stage, another industry — the pattern elsewhere

engineering.com

Siemens and P&G are rolling their jointly developed Visual Inspection Cockpit (VIC) out across P&G's manufacturing operations worldwide.

It inspects products in real time at full line speed; depending on the product, scrap rates are down 10 to 20 percent, and new deployments commission five to ten times faster than traditional custom vision systems. P&G's deep-learning models run near the equipment on Siemens Industrial Edge with Nvidia-GPU industrial PCs, and the system can automatically trigger alerts or removal of defective products from the line.

ManufacturingAI / MLStage · Production
Codex check · partly supportedRead the take