Prasenjit Sarkar (@stretchcloud) on X

What it is

A post on X by Prasenjit Sarkar (@stretchcloud) promoting Campfire, a self-hosted tool the author built to run several coding agents under shared approval controls. It also relays a Forever Security finding about planted instruction files. The finding is second-hand: the post links no primary report, and the post's only date is a quoted tweet from 26 October.

How it works

Per the post, Forever Security found the issue by accident. Their tooling blocked a known malicious npm install, and tracing it back led to a markdown file in a Downloads folder. The file was plain text, not a program. Both agents treat instruction files such as AGENTS.md as trusted by default, so the planted text was followed as instructions.

Reported outcomes differ by tool:

• Codex followed the planted instruction on the first try more than 90% of the time and had a rogue MCP server added to its config.
• Claude Code followed it about half the time. Its API traffic was rerouted and its OAuth token was taken from the session.

The post also cites the February Cline compromise, where a poisoned GitHub Actions cache put a malicious release on roughly 4,000 machines. It says no markdown trick was involved there.

What to do

The post's own answer is Campfire, which it says runs with one command:

bunx the-campfire

It runs Claude Code, Codex, Goose, Aider and OpenHands in one tab. Risky actions require a vote: a majority approves, any single deny blocks, and a 30 second timer prevents stalls. Session replay shows which file or tool call triggered an action. The post gives no other mitigation, such as vetting instruction files or checking MCP config and token handling.

Caveats

• The success rates have no stated sample size, tool versions or test setup.
• "This week" is relative and the post carries no absolute date.
• The post does not say how a malicious markdown file reached the Downloads folder.
• Campfire is the author's own product, and the post does not show it stopping the described attack.