vibehacker
News
BleepingComputer ·

A web page can drop an AGENTS.md into ~/Downloads and hijack a coding agent started there

Forever Security traced a customer's agent trying to install the malicious npm package function-color to an AGENTS.md in ~/Downloads, its working directory, then reproduced the attack on Codex (90% success with a harmless payload) and used a malicious CLAUDE.md to leak Claude Code's OAuth token. There's nothing for vendors to patch, so start agents in the project root, never ~/Downloads, and read unfamiliar instruction files first.

Read at bleepingcomputer.com
Claude Code
An AI coding agent for terminal, IDE, web, and Slack

More news

View all

Claude Enterprise gets unified chat and Cowork, with agentic work in isolated cloud VMs

Now GA for Enterprise (Oct 23), every conversation starts as chat and moves into an Anthropic managed cloud VM, network egress off by default, when it needs to run code or touch files, and keeps going after you close the laptop. It's off by default for existing orgs until it switches on Nov 16 (Organization settings Capabilities), and isn't available yet for ZDR, HIPAA ready or CMEK setups (admin guide)…

Anthropic

OpenAI's Decisions API is now GA, with prompt caching, JSON inputs and 400 questions per call

Out of beta since Oct 22, the gpt 6 luna endpoint for yes/no, pick one and score questions adds prompt caching ($0.01 per 1M cached input tokens, $0.10 uncached, still no output charge), native JSON inputs, images in question instructions, US and EU residency, GPT Live integration, and up to 400 questions per request. Datadog says it scores the risk of agent generated shell commands before running them at 40x faster p95 than frontier models, which makes it a cheap gate for an agent's next step…

OpenAI

Major US banks start blocking third-party AI agents that log in to customer accounts

Axios reports Morgan Stanley has begun blocking third party agents, and JPMorgan, Bank of America and Citi are restricting them, after banks found agents using customers' own credentials and sometimes acting beyond user instructions. Most banks are moving toward read only access, so if your agent touches finances, plan on open banking APIs rather than a user's login…

Axios

Official MCP filesystem, fetch and everything servers patch eight vulnerabilities in v2.1.0

Released Oct 25, the fixes stop symlink and path tricks that let the filesystem server write or peek outside allowed directories (Windows only partly fixed), block other web origins from calling the everything server over HTTP, and close SSRF gaps in fetch via IDNA host names and NAT64 addresses. Package managers rank 2.0.1 below old date versions, so install it explicitly, e.g. npm install @modelcontextprotocol/server [email protected] , and update mcp server fetch to 2026.10.24…

GitHub (modelcontextprotocol/servers)

Showboard lets Claude Code, Codex or Cursor answer data questions with dashboards from read-only SQL

The MIT licensed MCP server takes your agent's SQL and a short layout, runs each query read only against Postgres, SQLite, Excel or CSV, and draws charts, tables and headline numbers in a browser or a pane beside your terminal, with every number showing its query. Version 0.4.1 (Oct 22) adds a Claude desktop extension; install in Claude Code with /plugin install showboard marketplace rohanbeingsocial/showboard , and treat the author's 2.7x cost saving as a single dataset test (benchmark breakdown)…

GitHub (rohanbeingsocial/showboard)

Spotted something we missed? Start a thread.