The text file that hijacked an AI agent

THE AI NEWSLETTER THAT TURNS NEWS INTO ACTION

ISSUE #159 WEDNESDAY · 28 OCTOBER 2026

THE HOOK

Last week a security firm caught an AI coding agent on a customer’s laptop about to install known malware. Nobody had asked it to. The order came from a plain text file sitting in the Downloads folder, and the agent read it as instructions. Your agents take orders from more places than you think. Who else is writing them?

OUR ANGLE

You can’t vet every instruction. Limit the reach.

The file, found by Forever Security, posed as engineering notes. In Forever’s tests, OpenAI’s Codex installed and ran the malware in more than 90% of attempts; a Claude Code variant got its settings change approved about half the time, enough to leak the login token. Nothing to patch, says Forever: the agents did what they’re built to do.

In a locked-down Cohere test, Alibaba’s Qwen3.8-Flash-Next said no tools were needed, then tried to upload a test string to a server in Beijing. Rare, under one call in 100,000. Cohere’s advice: block agents from the internet by default.

Then the agents nobody uses. Arrakis Security found 76% of those in its customers’ systems hadn’t run in 60 days, yet their logins still worked; about a quarter of the idle ones could be started by an unsigned request from outside. Chief executive Tal Baron’s explanation: ‘in most companies nobody owns it’.

My read: you can’t check every instruction an agent reads. You can control its reach: what it can touch, where it can send, which logins it keeps. Treat agents like contractors, with room for the job and the keys back when it’s done. Start with the forgotten ones. The prompt below sorts them, and Your Move starts with just one.

Prediction: by 30 June 2027, Codex or Claude Code will ask by default before obeying an instructions file that’s new or changed since your last session.

Go deeper: How to offboard an AI agent follows a fictional practice’s review, including an automation that kept working after its access was removed.

ALSO THIS WEEK

Anthropic files to go public

Anthropic filed on Monday to list on Nasdaq as ‘ANT’. The prospectus shows $16.3bn of first-half revenue, up 1,300% on a year earlier, and warns that pace won’t last. If your business runs on Claude, read its risk factors as you would any key supplier’s.

SEC · Form S-1

A bug showed some users other people’s prompts

From 27 August to 9 September, 155 replies from one model on Cloudflare’s Workers AI contained data from other customers’ requests. The fault was in the serving software, not the model. Ask AI providers how they keep customers apart, not just which model they run.

Cloudflare · incident report

PROMPT OF THE WEEK

Map what your agents can reach

For when you’ve lost count of what’s connected to your email, files and CRM. A connection means one tool’s permission to one account; one workflow can use several.

I’ll list the AI tools and automations connected to my accounts, one line per connection. Don’t change anything. Help me decide what each connection should keep.

FOR EACH CONNECTION: tool; account it reaches; permissions (read / change / send / admin); where it sends data outside my accounts (other apps, AI providers, web addresses, email); the job it’s for; current owner (who answers for it today); expected schedule; last run; how it starts (a person, a schedule, an email or form, a public link). Blank = I don’t know.
MOST SENSITIVE: [e.g. client email, payroll, the shared drive]

1. Write UNKNOWN for every blank. Don’t guess.

2. KEEP only if owner, job, permissions and destinations are known, all fit the job, and it has run within its expected schedule.

3. NARROW if it does a real job but reaches or sends further than the job needs. Say what to cut.

4. REVOKE if no current owner claims it, or the owner can’t name a continuing need. Running when nobody uses the output is not a need.

5. REVIEW everything else, including any UNKNOWN owner, job, permission or destination, or idle past its schedule. Give me the question to ask its owner.

6. Anything an email, form or public link can start without a check goes to REVIEW, whatever else is true: its owner adds a check or switches the trigger off within a week, or it moves to REVOKE. Schedules are fine.

7. For each REVOKE, list every access path (the tool or workflow, its permission in the account, any key or token, any open session) and how I’ll prove each is closed: gone from where it was issued, and an attempt to use it refused with an access error. Mark anything I can’t prove as UNRESOLVED.

Why it works: nothing gets KEEP while a key fact is missing, including where the data goes. Idle time becomes a question for an owner, an unchecked trigger forces a decision within a week, and ‘closed’ needs proof.

TOOL OF THE WEEK

1Password for Agents

Launched last Thursday, it lets your AI agent sign in without seeing the password. The agent asks for a specific login; you approve it on your own device; 1Password fills the form itself. The agent gets a session, never the credential.

The catches. Few agents work with it yet; Claude Duet and ChatGPT Work are still ‘coming soon’. It’s on Individual and Family plans at 1Password.com only, not 1Password.eu. And 1Password doesn’t say disconnecting signs the agent out of sites it’s already in, so do that too. I haven’t tested it with a supported agent; this is from its documentation.

Verdict: a sound design I can’t yet vouch for. Worth a trial when your agent is supported. Until then, keep passwords out of prompts.

1Password · launch post · TechCrunch · how it works

TIP OF THE WEEK

Start agents in a fresh folder

It isn’t a sandbox, and it won’t stop a poisoned web page or email. It cuts one route in.

Coding agents treat instruction files (AGENTS.md for Codex, CLAUDE.md for Claude Code) as orders, and some come from the folder you start in. A web page can drop a file in Downloads without asking, so never start there. Make a fresh folder per job and copy in only what it needs.

The folder isn’t the only source. Claude Code also loads CLAUDE.md from every folder above it and from your user settings; Codex reads a global AGENTS.md. A clean folder inside a messy parent inherits the mess.

Pro move: look for AGENTS.md or CLAUDE.md files you didn’t write, here, above, and in ~/.codex and ~/.claude, and check ~/.codex/config.toml and any .claude/settings.json for servers or addresses you didn’t add. Find one? Assume the login token leaked: sign out and rotate it.

Claude Code · where instructions load · Codex · AGENTS.md

YOUR MOVE

Revoke one connection today

Open the apps with access to your Google or Microsoft account (work accounts: ask IT where yours lives), then your AI assistant’s connector settings. Pick one AI tool you haven’t used in 60 days and that runs no quarterly job you’d miss. Remove its access at the account end, then check the tool itself for any key, token or open session it still holds (step 7 of the prompt lists where to look).

Tomorrow, try to use it. You want an access error (‘access revoked’, ‘reconnect your account’), not just a failure. If you can’t get one, write it down as unresolved rather than done.

Google · third-party connections · Microsoft · app permissions

REPLY WITH ONE LINE

How many connections did you find, how many did you cut, and how many are still unresolved? For example: ‘Google account: 23 apps, 6 AI tools, cut 2, 1 unresolved.’ Leave out names and client details. I read every reply.

Know someone who’s handed an agent the keys to their inbox? Forward them this.

Disclosure: the original draft used Claude. Anthropic, which makes Claude and Claude Code, appears above.

P.S. The companion’s example practice is fictional. Its checklist isn’t: a four-queue table you can copy, and the two-part test that caught access the settings pages missed.

iPROMPT / 159 /