Skip to content
PERMISSION/PROTOCOL
Back to incident tracker

2026-10-22

HighPrimary

Planted Downloads Instructions Can Redirect Coding-Agent Configuration, Execute Packages and Expose Tokens

Forever Security reports a blocked customer malware attempt and controlled Codex and Claude Code configuration-poisoning demonstrations.

OpenAI Codex and Anthropic Claude CodeGovernance bypassObserved blocked prompt-injection attempt with separate controlled configuration-poisoning demonstrationsCoding agents opened in Downloads and able to modify their own configuration; researchers tested consequential execution in an isolated VM

What happened

In controlled tests, the victim-workflow agents modified configuration, launched child sessions and executed package-installation paths. The Claude variant directed token-bearing requests to a researcher endpoint, which supplied tool calls; the researchers separately replayed a captured OAuth token.

Why it matters

The customer malware installation was blocked before code ran. Code execution, persistent configuration changes and OAuth-token takeover are reported research outcomes, not established customer impact. The delivery mechanism of the original customer file remains unknown.

Missing authorization check

Independent operation-bound approval for machine-wide MCP registration, model-endpoint changes, token-bearing outbound destinations, package installation and child processes that disable safeguards.

Would PP block it?

An instructions file must not grant authority to mutate the agent's own controls. Enforcement outside that mutable configuration can require authentic approval bound to the exact MCP command, endpoint and child-process arguments. An approved endpoint change or an ungated child process remains outside this prevention claim.

Incident analysis

Timeline and technical read

Timeline

  1. 2026-10-22

    Forever Security publishes its customer-attempt investigation and separate Codex and Claude Code configuration-poisoning demonstrations.

Technical breakdown

  • The observed AGENTS.md wrapped a malicious package-installation path in ordinary engineering setup instructions; the source does not establish how it reached the customer's Downloads folder.
  • The Codex research chain wrote a machine-wide MCP registration, then used a fresh child session with bypass flags to activate it. A detached process allowed package installation to outlive the MCP handshake.
  • The Claude research variant changed the model API endpoint through project settings. The source explicitly says such writes required a human to approve them.
  • Researchers captured a token sent to their endpoint and successfully replayed it against the real API; a substituted model response could also supply executable tool calls.
  • Most testing used a harmless canary. The source states that one real-malware execution occurred in an isolated VM and that the original customer attempt was stopped.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Governance bypass. The relevant Permission Protocol gate is Runtime Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
Configuration-write, credential-bearing network, package-execution and child-process boundaries outside the agent's mutable settings
Still needs
PP cannot recover an already disclosed token, establish the original customer's file-delivery path or substitute for endpoint protection. The Claude demonstration required human approval of configuration writes; this is not evidence of bypassing an explicit deny.
Receipt required for
Registering machine-wide MCP commands, changing model endpoints, releasing tokens to new destinations, installing packages and launching safeguard-disabled child sessions

An integrated independent boundary could reject unapproved configuration changes, network destinations and process execution, but only when those sinks and child processes are actually covered.

Start small

Put the relevant gate at this action boundary.

This incident maps to Runtime Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop