A roundup post says a web page can drop an AGENTS.md into Downloads that agents then follow as instructions, and that Forever Security caught one live and reproduced it in Codex over 90% of the time; it also advises checking ~/.codex/config.toml for MCP se...
VQV Signal
OPEN SOURCE
WATCH
TECHNICAL
Coding agents: don't start them in ~/Downloads
A roundup post says a web page can drop an AGENTS.md into Downloads that agents then follow as instructions, and that Forever Security caught one live and reproduced it in Codex over 90% of the time; it also advises checking ~/.codex/config.toml for MCP se...
A roundup post says a web page can drop an AGENTS.md into Downloads that agents then follow as instructions, and that Forever Security caught one live and reproduced it in Codex over 90% of the time; it also advises checking ~/.codex/config.toml for MCP servers you didn't add. The Forever Security findings weren't...
VQV organizes public signals from inspectable sources. It does not independently verify the underlying report.
Signal Strength 65%
Technical label WATCH
Public Interest 36
Category OPEN SOURCE
Reader Depth TECHNICAL
Signal Strength reflects source quality, relevance, freshness and evidence. Public Interest helps organize discovery; it is not proof of truth.
Public Interest components
Recognizable Entity Score 51
Practical Impact Score 8
Novelty Interest Score 48
Consequence Score 38
Curiosity Score 16
Shareability Score 49
Products
Topics
VQV surfaced this signal because it is recent, relevant to AI Coding Tools, connected to Scobleizer News Pulse (X).
No login, cookies, social SDKs, or automatic posting.