AGENTS.MD becomes malware: silent web poisoning hits Codex 90% of the time
量子位 · wechat · 2026-11-07
Security firm ForeverSecurity disclosed a new attack chain against AI coding agents: a webpage can silently drop an AGENTS.MD file into your Downloads folder; if you then launch Codex or Claude Code there, the AI treats it as dev instructions and executes them. In real-payload reproduction, the attack succeeded over 90% on Codex and 50% on Claude Code. The payload isn't an obvious injection but a 13KB "team environment setup spec" that appends malicious config: modifying global /.codex/config.toml to persist a rogue tool server, or rewriting ANTHROPICBASEURL to a hacker's reverse proxy to steal OAuth tokens and take over the terminal.
The article provides a 3-minute 4-step audit: check Downloads for unknown AGENTS.md/CLAUDE.md (watch for zero-width Unicode hidden prompts), inspect config.toml for suspicious mcpservers entries, search for the /tmp/ptools MALFEX packages, and verify ANTHROPICBASEURL hasn't been hijacked. Defenses: never launch agents in Downloads, audit all spec files, isolate /.ssh and .env from Bash permissions. Vendors can't patch this—reading spec files is intended behavior, like a browser rendering a phishing page.
More from coding & agent
- Gemini /teamwork agents caught live: four parallel task logs all running that second — RyanSpunk · 2026-11-13
- Codex CLI 0.168.0 adds model provider picker, side-by-side TUI workspace and animated GIF generation — github-actions[bot] · 2026-11-13
- Free MCP server lets Claude read Altium, Allegro, KiCad and Gerber PCB files directly — woodisruff · 2026-11-13
- a16z Partner Clones Open-Source Game with Fable 5.2 Agent, Which Finds Its Own Horse Animation Asset — FinanceYF5 · 2026-11-13
- OpenAI team shares how it runs and governs fleets of persistent agents internally — romainhuet · 2026-11-13
- Perplexity's Decider scanned 1B tokens across 7,000 agent sessions, found 14 security fixes — denisyarats · 2026-11-13