A web page can plant AGENTS.md in your Downloads folder: Codex obeyed it in over 90% of attempts
This story is from 2026-10-25. It is preserved in the archive; the latest stories are on the live feed.
Last week Forever Security stopped a coding agent on a customer's machine mid-session, right as it tried to install function-color , a known malicious npm package. The strange part was where the order came from. Not a dependency. Not a repository. It was an AGENTS.md file sitting in the customer's…
Read the full story at DEV Community — AI ↗
Timeline · 1 report
- 2026-10-25 18:50 · DEV Community — AI
A web page can plant AGENTS.md in your Downloads folder: Codex obeyed it in over 90% of attempts