AnalysisCybersecurityOctober 26, 2026

Malicious AGENTS.md file tried to make Codex install malware

Read original source →thehackernews.com

Forever Security caught a booby-trapped AGENTS.md in a developer's Downloads folder instructing an AI coding agent to install the npm package function-color, part of the MALFEX campaign that pulls in a downloader called function-flag. The firm reproduced the attack against Codex in an isolated VM and on a second coding agent.

1 source

More stories today

Open the live feed