Buchi Reddy B (@buchireddy) on X

What it is

A thread by Buchi Reddy B (@buchireddy) on X, summarising research by Gal Weizman and Omer Samet of Forever Security on prompt injection through project-rules files in Codex and Claude Code. The page is a commentary and a truncated excerpt. The full Forever writeup is not in the fetched text.

How it works

The test setup was a fake file titled "Engineering Work Guidelines" in a test Downloads folder. According to the thread, no click and no download prompt was involved: a web page quietly wrote the file. The researchers then opened Codex and Claude Code in that folder, and the agents treated the file as project rules (AGENTS.md or CLAUDE.md).

Buchi Reddy B singles out one result: Codex wrote the attacker's MCP server into the machine-wide config. In their words, a one-time prompt injection becomes a standing tool connection, loaded by every session in any folder. The thread also mentions a "90%" figure, but the fetched text does not say what it measures.

Preconditions / Affected

• The agent is opened in a folder where a web page can write files, such as Downloads.
• The agent reads AGENTS.md or CLAUDE.md in that folder as project rules.
• For the persistence step, the agent can write to the machine-wide config. The thread reports this for Codex only.

What to do

• Do not open Claude Code or Codex in your Downloads folder. This is the thread's direct request.
• Inventory the MCP servers your agents connect to at runtime and compare them with the approved list. The thread poses this as a question and gives no tooling or commands.

Caveats

The thread is secondhand commentary. It gives no versions, no method for the "90%" figure, and no detail on which browsers or pages can write the file. The thread does not say whether Claude Code also persisted an MCP entry.