Tooling11d ago
Forever Security: a web-planted AGENTS.md in ~/Downloads hijacked Codex into installing npm malware in 90%+ of tests; a CLAUDE.md variant leaks Claude Code OAuth tokens about half the time
On Oct 22, Forever Security researchers Gal Weizman and Omer Samet reported that they had stopped Codex on a real customer machine as it tried to install the known-malicious npm package function-color, following an AGENTS.md in ~/Downloads the customer had never seen. A web page can drop a file into Downloads with no click, and an agent started there obeys it. In their reproduction Codex rewrote the machine-wide ~/.codex/config.toml to register a malicious MCP server in more than 90% of attempts; a CLAUDE.md they crafted made Claude Code point ANTHROPIC_BASE_URL at an attacker server and leak its OAuth token about half the time. The researchers say there is no vendor bug to patch; The Hacker News and others covered it on Oct 26.
Tooling42d ago
Mid-task Jev in Codex raises/lowers GPT-6 Astra reasoning effort; author reports ~50% Astra cost cut without breaking prompt cache
@miu21590 demoed using Jev inside a running Codex session to raise/lower GPT-6 Astra reasoning effort—more thinking when stuck, less on routine steps—reporting ~50% lower Astra costs and faster runs without breaking prompt caching. Versus the usual pre-task Jev model pick, this wires the decision model mid-run for cost control.
Tooling2d ago
ChatGPT adds account switching: stay signed in to up to 2 accounts, rolling out on iOS and Android, desktop coming soon
On October 31, Tibo (@thsottiaux), who works on Codex and ChatGPT at OpenAI, announced on X, as day 26 of his daily shipping posts, that ChatGPT mobile now supports switching between accounts, with desktop coming soon. OpenAI's updated Help Center article says users can stay signed in to up to 2 accounts with one active at a time; chats, memory, files, subscriptions, billing and workspaces stay separate, and switching never moves or merges data. The post drew about 10,000 likes and 1.36M views.
Discussion & Comments
0Sign in to join the discussion
Connect with AI developers to exchange benchmark insights.