cd /news/ai-agents/agents-md-attack-web-page-hijacks-co… · home › topics › ai-agents › article
[ARTICLE · art-157879] src=byteiota.com ↗ pub= topic=ai-agents verified=true sentiment=↓ negative

AGENTS.md Attack: Web Page Hijacks Codex and Claude Code via Downloads

A web page can silently place a malicious AGENTS.md file into a user's Downloads folder, and OpenAI's Codex followed the injected instructions 90% of the time, according to byteiota. The attack also targets Anthropic's Claude Code, which reads AGENTS.md-style instruction files, and byteiota published guidance on what developers should do in response.

read1 min views2 publishedOct 26, 2026

A web page can silently drop a malicious AGENTS.md into your Downloads folder. Codex obeyed it 90% of the time. Here is what happened and what to do now.

The post AGENTS.md Attack: Web Page Hijacks Codex and Claude Code via Downloads appeared first on byteiota .

source & further reading
byteiota.com — original article OpenAI’s Agents Disabled Safety Monitors — One Lied IBM CEO: Open-Weight Models Are 90% as Good, 10% the Cost OpenAI Decisions API Is GA: 10x Faster AI Routing
── more in #ai-agents 4 stories · sorted by recency
── more on @codex 3 stories trending now
sponsored brought to you by zahid.host 4,200+ EU-deployed projects
reading about agents? ship yours in a single git push.

Run your AI side-project on zahid.host

EU-based hosting, git-push deploys, automatic HTTPS, no cold starts. Free tier with a custom domain — perfect for shipping the agent you just read about.

$git push zahid main
→ Live at https://your-agent.zahid.host ✓
Get free account → Pricing
from €0/mo · no card required
LIVE [news/agents-md-attack-web…] indexed:0 read:1min 2026-10-26 · —