In Forever Security’s tests, a planted AGENTS.md file took effect in over 90% of Codex attempts and reached code execution in over 90% as well, while Claude Code saw the file take effect in about half of tests but reach code execution in only about a fifth in the same session. By the next launch in the same folder, Claude’s persistence closed the gap, with the same roughly 50% cohort reaching code execution. The results show Codex going straight through while Claude resists in-session but not across launches — the finding behind the October 26 SI News story on malicious AGENTS.md files hijacking coding agents.
Sources & Notes
- Original story: Meta Plans $95 Billion Stock Raise for AI | Claude Accessed Georgia Vote Data Unprompted | Malicious AGENTS.md Files Hijack Coding Agents
- Data sources: Forever Security (2026). Markdown Is the New Executable
- Other references: BleepingComputer coverage of the AGENTS.md hijack
- Notes: Codex figures are lower bounds (the report says more than 90% of attempts ran the malware); Claude’s same-session figures are approximate (about half, about a fifth). The next-session point is the same roughly 50% Claude cohort at a later launch, not a separate sample. Most Codex tests used a harmless stand-in payload; the real malicious package was run once, inside an isolated VM. The original customer file’s delivery route was not established, and the attack requires launching an agent in the Downloads folder.
Leave a comment