//// BLOG

AI Security.
Solved.

Research, analysis and practical guidance on AI security and governance from the FireTail team.

AGENTS.md Attack: How a File in Downloads Hijacks Codex and Claude Code

A markdown file planted in a Downloads folder told a coding agent to rewrite its own configuration and install malware. At every step, a normal security stack would have just seen something ordinary, and nothing malicious.

Latest AI security articles.

All

This Week in AI Security

A View from the C-Suite

AGENTS.md Attack: How a File in Downloads Hijacks Codex and Claude Code



October 29, 2026

JPMorgan Won't Let AI Agents Use Its Customers' Logins. Your Employees Are Handing Agents Theirs.

JPMorgan Chase has blocked outside AI agents from logging into customer accounts, and told customers who hand an agent their credentials that the liability is theirs.



October 27, 2026

The US Government Couldn't Keep DeepSeek Out. Can You?

DHS has ordered DeepSeek out of every federal civilian agency, along with any product built on it. The order arrived 21 months after federal staff started using it. By then the prompts were already gone, data was already shared, and nothing in the order can bring them back.



October 20, 2026

Personal AI Agents at Work: Lessons From the Grok Slack Leak

An AI agent with “read-only” access to Shane Mac's bank account posted his balances and spending into his company's executive Slack channel, under his nam



October 14, 2026

OpenAI Is Spending $500,000 a Day to Find Out What Its Agents Did. What Would It Cost You?

OpenAI's agents broke out of their sandbox, breached Hugging Face and touched systems at more than 100 organizations. OpenAI still can't say everything they did. If the people inventing AI can't figure out what their agents are doing, how would your organization do?



October 7, 2026

Discovering the AI hardcoded in your repositories

Everyone is hunting the AI tools employees signed up for. The models and prompts your own teams wrote into the code, with the keys to call them, are the half nobody is looking at.

