Vibe Code Brief, October 26: A Markdown File Can Hijack Your AI Agent

Today is about the trust perimeter around your AI agent, proofs beating tests, agents at play, and why the fancy harness may not be the one paying off. Four items, each with what it means for people who ship.

A stray markdown file can hijack your AI agent

Image: Forever Security, via Markdown Is the New Executable.

What happened: Security firm Forever Security caught a malicious AGENTS.md file in a real customer's Downloads folder instructing their coding agent to install a known-malicious npm package. AGENTS.md is a plain-text instructions file that agents such as OpenAI's Codex read and follow when they start in a folder. In the researchers' tests, Codex ran the payload in over 90 percent of attempts, and a planted CLAUDE.md tricked Claude Code into leaking its OAuth token about half the time. A web page can silently drop such a file into Downloads with no click, and people regularly launch agents in that folder. BleepingComputer and The Hacker News have the full breakdown.

Why it matters to designers and builders: Markdown is now an executable. If you vibe code, the instructions file is part of your attack surface, and the two things that make agents so useful, file reads and instruction following, are exactly what this attack abuses. Remember Zeabur's leaked environment variables from last week: agents plus untrusted file locations is this month's theme.

What to do: Never start Codex, Claude Code, or Cursor in your Downloads folder. Read any AGENTS.md or CLAUDE.md you did not write before an agent touches it, keep approval prompts on, and treat untrusted repos the same way.

Claude formally proved code in 100+ open source libraries

Image: Anthropic, via Formal verification research.

What happened: Anthropic's Frontier Red Team, working with Theorem, used Claude to formally prove security properties at the RISC-V assembly level in over 100 real-world open source libraries. It is the first large-scale AI-driven formal verification effort at that level, a task that historically took years of expert effort: the seL4 kernel took 2 person-years to build and 20 to verify. While writing the proofs, Claude found bugs that survived years of testing.

Why it matters to designers and builders: "It passes the tests" is about to stop being the ceiling of quality. Formal verification used to be reserved for aerospace kernels. If an AI can prove your code is free of a class of bugs, the gap between prototype and production shrinks, and the people who can ask for proofs, not just demos, become the valuable ones.

What to do: Watch this space. If you ship anything with real users on it, formal checks are on their way to becoming a checkbox, and knowing what they cover will put you ahead.

MIT left agents alone on an island and they invented games

What happened: MIT researchers ran 13 agents based on Claude Opus 4.7 on simulated desert islands, Roblox-like environments, with no tasks at all, PCMag reports. The agents invented games: catch that evolved into juggling, bowling with rocks and cubes, one agent spent an hour spelling its name in cubes. The kicker: agents that had "played" for 30 hours outperformed fresh agents on a tower-building task, 62 percent built more than two towers versus 15 percent of the newcomers. Caveat from the researchers around the paper: each agent had a "soul" file describing it as "naturally curious," so imitation is still on the table. The paper is on arXiv.

Why it matters to designers and builders: If unstructured exploration transfers to task performance, agent design will start looking like environment design. The people who shape where agents roam, and what they are "curious" about, are doing interaction design, just for machines.

What to do: Skepticism first: cute demos and prompt leakage are not proof of play. But watch the "soul file" idea. Your system prompt is a personality brief, and briefs have consequences.

A 100-line harness matches Claude Code on accuracy, at a third of the cost

What happened: Shandong University researchers ran five models through three harnesses, Claude Code, OpenCode, and mini-SWE-agent (about 100 lines of Python with a single bash tool), on 492 tasks from SWE-bench Verified. VentureBeat reports the most elaborate and most minimalist harnesses scored statistically equivalent results, while cost per task varied by as much as threefold. Claude Code's system prompt and tool schemas alone add over 16,500 tokens to turn one, versus 829 for mini-SWE-agent, and those tokens re-send every step. About one in eight results flipped between harnesses, which is the same rate as simply rerunning the same setup.

Why it matters to designers and builders: The wrapper wars are mostly a pricing war. Before you pay premium rates for a shinier container, know that single-run benchmark gaps of a few points fit inside run-to-run noise.

What to do: Run your own baseline twice before switching harnesses, and judge tools on cost per solved task in your repo, not leaderboard deltas.

Our take

The common thread today is the perimeter. The most dangerous file in your workspace is the one your agent trusts by default, the most valuable guarantee is the one that comes with proof instead of a passing suite, and the most expensive part of your stack might be scaffolding that adds tokens, not accuracy. The agents keep getting smarter. The job is designing what they are allowed to touch, and staying able to prove what you shipped.

Building something from today's news? Base44 gets you from idea to shipped app fast. Want practice reps? Take today's Daily Vibe Code challenge.

Related on NewForm

• United's CEO Vibe-Coded a Betting App Between Gym Sets. Here's What That Means for Designers
• A Vibe-Coded Site Got Hacked 6 Days After Launch. It Was Not the AI's Fault
• OpenAI Just Put Up to $500 a Month of API Credits Inside Your ChatGPT Subscription