Forever Security found a malicious AGENTS.md in a customer's Downloads folder and reproduced the attack on OpenAI Codex and Claude Code in lab tests. Success rates were about 90% for Codex and about 50% for a Claude Code variant.
Sophos X-Ops telemetry analysis shows Claude Code, Cursor, and OpenAI Codex triggering behavioral EDR detection rules built to catch human attackers. Credential access patterns account for 56.2% of blocked activity -- agents using the same Windows DPAPI technique as Redline stealer.
New AI Now Institute research shows Claude Code and OpenAI Codex can be hijacked into executing attacker-planted malware while performing routine security audits of open-source code — a design flaw that model updates cannot fix.
Mozilla's Zero Day Investigative Network published research showing that Claude Code, Cursor, GitHub Copilot, and Gemini CLI can all be manipulated into executing attacker-controlled payloads delivered via DNS TXT records from seemingly clean GitHub repositories.
A solo researcher has documented 9,330 malicious GitHub repositories designed to poison AI coding agent sessions and deliver credential-stealing malware via blockchain-hosted C2 infrastructure.