AI 보안 · AI 에이전트 · LLM기타 산업 (software / AI coding agents)
Forever Security(갈 바이츠만·오메르 사메트, 10월 22일)는 웹사이트가 사용자 조작 없이 ~/Downloads 폴더에 떨어뜨린 악성 AGENTS.md·CLAUDE.md 파일이 OpenAI Codex와 Claude Code를 조종해 공격자 명령을 실행하게 만드는 실제 공격을 확인했다고 밝혔다.
출처 [1] forever.security · 2026년 10월 22일 · “Markdown Is the New Executable: Attackers Are Dropping Agent Instructions Into Your Downloads Folder From the Web” ↗
도입 단계: 운영 — A named organisation runs it in day-to-day operations.
요약
Forever Security(갈 바이츠만·오메르 사메트, 10월 22일)는 웹사이트가 사용자 조작 없이 ~/Downloads 폴더에 떨어뜨린 악성 AGENTS.md·CLAUDE.md 파일이 OpenAI Codex와 Claude Code를 조종해 공격자 명령을 실행하게 만드는 실제 공격을 확인했다고 밝혔다. Codex는 ~/.codex/config.toml에 악성 MCP 서버를 등록해 알려진 악성코드인 function-color npm 패키지를 설치하게 되며 테스트 성공률 90% 이상, Claude는 ANTHROPIC_BASE_URL로 API 트래픽을 공격자 도메인으로 돌려 OAuth 토큰 탈취와 코드 실행에 이르며 초기 침해 약 50%·같은 세션 실행 약 20%였다. 회사는 "OpenAI나 Anthropic이 패치할 것이 없다"며 Downloads에서 에이전트를 띄우지 말고 설정 파일을 감사하며 승인 게이트와 샌드박스를 유지하라고 권고했다.
Kenny의 관점
뚫린 것은 모델이 아니라 "작업 폴더의 지시 파일을 믿는다"는 에이전트의 설계 그 자체이고, 공격자는 그 폴더에 파일을 넣는 데 브라우저의 30년 된 기능을 썼다. Forever Security 스스로 패치할 것이 없다고 말한다. 남는 통제는 운영 규율이다 — Downloads에서 에이전트를 띄우지 않고, 설정 파일을 감사하고, 승인 게이트와 샌드박스를 끄지 않는 것. 이 판단은 OpenAI나 Anthropic이 지시 파일 신뢰 범위를 제품 차원에서 바꾸면 약해진다.
AI 초안 · Kenny 검토 승인
분석 (영문)
What happened (vendor-reported, according to Forever Security): a live indirect prompt-injection attack on AI coding agents, published October 22, 2026. Who: developers running OpenAI Codex or Claude Code; the attacker is not named. Vector: a browser-dropped AGENTS.md or CLAUDE.md in ~/Downloads that the agent reads as project instructions. Impact as stated: for Codex, a persistent malicious MCP server that installs the function-color npm package, over 90% success in testing; for Claude, API traffic redirected via ANTHROPIC_BASE_URL leading to OAuth token theft and code execution, about 50% initial compromise and about 20% same-session execution. The source gives no count of affected organisations.
Control: stated in the source — do not start an agent in ~/Downloads, audit for unexpected instruction files, check ~/.codex/config.toml and .claude/settings.json for injected entries, and keep approval gates and sandboxes on rather than using bypass flags. The source's own position is that there is no vendor patch because the agent is behaving as designed.
For the pattern indirect-prompt-injection, the stage is set to production because, per the source, the attack ran against real deployed agents with real malware (function-color, since removed by npm), not in a lab. Nothing in the source touches ships, plants or grids, so it adds no direct evidence to q-agent-security-ot; it is a software-tooling incident.
원문에서 확인한 사실 (영문)
- F1According to Forever Security (authors Gal Weizman and Omer Samet, published October 22, 2026), it "identified a live attack where malicious markdown files (AGENTS.md or CLAUDE.md) planted in the ~/Downloads folder can manipulate AI coding agents (OpenAI Codex, Claude Code) into executing attacker commands". [1]
- F2The stated key risk: "Websites can silently drop files to Downloads without user interaction, and agents automatically trust and execute instructions from files in their working directory." [1]
- F3Against Codex, the planted file "tricks Codex into modifying ~/.codex/config.toml to register a malicious MCP server that installs the function-color npm package (known malware)"; success rate ">90% in testing"; the change "persists machine-wide across all future Codex sessions". [1]
- F4Against Claude, the attack "redirects Claude's API traffic via ANTHROPIC_BASE_URL environment variable to an attacker-controlled domain", resulting in OAuth token theft (account takeover) and arbitrary code execution via spoofed model responses; success "~50% for initial compromise; ~20% for same-session execution". [1]
- F5The function-color npm package is listed as the indicator of compromise, "removed by npm; real malware used in live attacks". [1]
- F6Quote: "There is nothing here for OpenAI or Anthropic to patch. An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do." [1]
- F7Recommended mitigations: never start Codex, Claude Code or any agent in ~/Downloads; audit for unexpected AGENTS.md or CLAUDE.md files; check ~/.codex/config.toml for unexpected [mcp_servers.*] blocks and project .claude/settings.json for unauthorised ANTHROPIC_BASE_URL entries; "Maintain approval gates and sandboxes; distrust bypass flags"; rotate credentials immediately if compromised. [1]
언급된 조직: Forever Security, OpenAI, Anthropic
반론 — Codex 검증 메모
Codex가 각 문장을 원문과 대조하고 반대 증거를 찾은 기록입니다 (영문 원문). 판정: Codex 검증 · 부분 일치.
- 반대 증거The full article clarifies that the customer attempt was blocked before code ran, the file's arrival route was unknown, and the Claude Code attack was a separate test.
- 반대 증거BleepingComputer independently verified a harmless download proof of concept, but says the real file's delivery route was undetermined; it also found browser notifications or approval prompts in some browsers. [2]
문장별 검증 메모 12건
- factspartly-supported: Forever Security identified a live attack involving malicious AGENTS.md or CLAUDE.md files against Codex or Claude Code. — The condensed source conflates the observed customer incident with later tests. The full article identifies one observed AGENTS.md attempt, stopped before code ran; the Claude Code variant was researcher-created and tested.
- factspartly-supported: The Codex payload registers a malicious MCP server that installs function-color; testing succeeded more than 90% of the time and the configuration persists machine-wide. — The mechanism and figure match the source, but the test result is an unconfirmed vendor claim stated as fact in this bullet.
- factspartly-supported: The Claude payload redirects API traffic through ANTHROPIC_BASE_URL, enabling token theft and code execution; test rates were about 50% and 20%. — These are Forever Security's unconfirmed tests, not an observed Claude Code incident; the bullet states the outcome without that attribution.
- summary_enpartly-supported: A website silently dropped the file in the live attack, which involved either AGENTS.md or CLAUDE.md. — The delivery route in the customer incident was unknown. Only AGENTS.md was observed there; the CLAUDE.md path was tested afterward.
- summary_enpartly-supported: Any coding agent started in Downloads follows the file as trusted instructions. — The source qualifies which agents are susceptible; it does not establish that every coding agent will follow the file.
- summary_kopartly-supported: The live attack used website-dropped AGENTS.md and CLAUDE.md files to control both Codex and Claude Code. — The Korean summary makes the unknown delivery route and the separately tested Claude variant sound like observed parts of the live incident.
- analysispartly-supported: The incident vector was a browser-dropped AGENTS.md or CLAUDE.md file. — Browser delivery was demonstrated in a test, not established for the observed customer incident; no CLAUDE.md was observed in that incident.
- analysispartly-supported: The incident's impact included the stated Codex and Claude Code compromise outcomes. — The real attempt was blocked before code ran. The execution and token-theft outcomes and rates came from vendor tests.
- analysisunsupported: The attack ran against real deployed agents with real malware, not in a lab, justifying production stage. — The observed attempt was stopped before code ran; the successful execution was a controlled test. No named organisation is identified as running this pattern in day-to-day operations.
- takeunsupported: The attacker used a 30-year-old browser capability to place the file. — Both English and Korean takes present the demonstrated browser-delivery route as the known route of the real attack.
- frontmatterpartly-supported: OpenAI and Anthropic are organisations involved in carrying out the reported incident. — They are named as the makers of the tested agents, not as the victim, attacker, or operator of the observed incident. The source title and publication date match.
- stageproduction → research: The successful chains and rates are vendor tests. The single observed attempt was blocked, and the customer and attacker are unnamed; the taxonomy's production rule requires a named organisation running the pattern in day-to-day operations.
출처
이어 읽기
Stay in the loop.