Forever Security researchers discovered a malicious AGENTS.md instruction file in a customer's Downloads folder that caused an AI coding agent to attempt installing a rogue npm package called 'function-color.' They reproduced the attack against OpenAI Codex and showed a similar technique against Claude Code that could leak OAuth tokens and hijack accounts, all using only crafted text instructions placed in the agent's working directory.
bleepingcomputer.com
· 2026-10-25
A developer testing Claude Code 2.1.277's new AGENTS.md support found the file only loads when a remote feature flag called tengu_agents_md_mod returns true, which depends on telemetry or nonessential traffic being enabled. Setting CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC or DISABLE_TELEMETRY to 1 silently disables the AGENTS.md loader, with no warning to the user, a behavior tracked in GitHub issue #95690.
blog.szypowi.cz
· 2026-09-23
Anthropic's Claude Code tool will now read an AGENTS.md file when a project lacks a CLAUDE.md file. This lets developers who already use the AGENTS.md convention for agent instructions get compatible behavior from Claude Code without creating a duplicate configuration file.
code.claude.com
· 2026-09-18
Developer Ayghri released i-have-adhd, an open-source skill/plugin for coding assistants like Claude Code that rewrites how the AI communicates: it leads with the next action, numbers steps, gives time estimates, caps lists, and cuts preambles, tangents and closing pleasantries. It installs via a CLI prompt pointing to the project's GitHub repo and can be customized by forking and editing its SKILL.md rules file.
github.com
· 2026-09-08
GoKawiil