function-color

Mentions · 7d4
Mentions · 30d4
All mentions4
First seenOct 25, 2026
Last mentioned4d ago

Timeline

4 articles · newest first

Malicious Downloads files can hijack Codex and Claude Code

Forever Security says a planted AGENTS.md or CLAUDE.md can change agent settings, install an npm package, or expose an OAuth token.

Cyber Security Newsupdated Oct 26, 20:59 UTC · 4d agofirst Oct 26, 16:35 UTC · 4d agoAI safety & security 7 sources2 · 1 read

Downloads-folder instruction files steer Codex and Claude Code

In Forever Security tests, Codex followed the planted file in more than 90% of attempts and Claude exposed a login token about half the time.

Help Net Securityupdated Oct 26, 20:59 UTC · 4d agofirst Oct 26, 11:26 UTC · 4d agoAI safety & security 7 sources1

Downloads-folder instruction file tried to make a coding agent install malware

Forever stopped the agent before code ran; Codex followed the planted file in more than 90% of isolated tests.

The Hacker Newsupdated Oct 26, 20:59 UTC · 4d agofirst Oct 26, 06:03 UTC · 4d agoAI safety & security 7 sources1

Malicious AGENTS.md files in Downloads hijack Codex and Claude Code

A customer agent tried to install npm package function-color; tests also stole Claude Code OAuth tokens in about half of runs.

BleepingComputerupdated Oct 26, 20:59 UTC · 4d agofirst Oct 25, 15:49 UTC · 5d agoAI safety & security 7 sources1

Appears with

Forever Securityorganization · 4
Anthropicvendor · 4
OpenAIvendor · 4
Claude Codeproduct · 4
Codexproduct · 3
Checkmarxorganization · 2
MALFEXmalware · 2
function-flagmalware · 2
Claudeai model · 1
CloudSEKorganization · 1
Codexai model · 1

Entities are extracted by the model from each article. First seen Oct 25, 2026, last mentioned 4d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.