Tooling12d ago
Forever Security: a web-planted AGENTS.md in ~/Downloads hijacked Codex into installing npm malware in 90%+ of tests; a CLAUDE.md variant leaks Claude Code OAuth tokens about half the time
On Oct 22, Forever Security researchers Gal Weizman and Omer Samet reported that they had stopped Codex on a real customer machine as it tried to install the known-malicious npm package function-color, following an AGENTS.md in ~/Downloads the customer had never seen. A web page can drop a file into Downloads with no click, and an agent started there obeys it. In their reproduction Codex rewrote the machine-wide ~/.codex/config.toml to register a malicious MCP server in more than 90% of attempts; a CLAUDE.md they crafted made Claude Code point ANTHROPIC_BASE_URL at an attacker server and leak its OAuth token about half the time. The researchers say there is no vendor bug to patch; The Hacker News and others covered it on Oct 26.
Tooling44d ago
Mid-task Jev in Codex raises/lowers GPT-6 Astra reasoning effort; author reports ~50% Astra cost cut without breaking prompt cache
@miu21590 demoed using Jev inside a running Codex session to raise/lower GPT-6 Astra reasoning effort—more thinking when stuck, less on routine steps—reporting ~50% lower Astra costs and faster runs without breaking prompt caching. Versus the usual pre-task Jev model pick, this wires the decision model mid-run for cost control.
Models27d ago
GPT-6 rolls out to all of ChatGPT with Intelligent UI: interactive charts and in-chat tools, Sol for paid tiers and Luna for free
On Oct 7 OpenAI began rolling GPT-6 out globally in ChatGPT together with Intelligent UI: the model decides when to answer with diagrams, interactive charts, forms, tappable buttons or small in-chat tools (calculators, games, bill splitters) instead of plain text. Plus, Pro, Business and Enterprise get it first on GPT-6 Sol; Go and free users follow on Oct 8 on GPT-6 Luna. OpenAI says GPT-6 can stream partial answers while still thinking, cutting wait times by 44%.
Discussion & Comments
0Sign in to join the discussion
Connect with AI developers to exchange benchmark insights.