Prasenjit Sarkar (@stretchcloud) on X

What it claims

Prasenjit Sarkar presents Campfire as a response to a failure mode in coding agents: they read instruction files such as AGENTS.md as trusted by default. The post says the planted-file attack reported by Forever Security got past both tools with concrete results. Codex had a rogue MCP server added to its config. Claude Code had its API traffic rerouted and its OAuth token taken from the session. Sarkar argues that nothing sits between an agent reading a file and acting on it, and that "single agent trust by default is the wrong default."

Evidence

Forever Security found the attack by accident. It blocked a known malicious npm install and traced it back to a markdown file in a Downloads folder. The file contained only text, not code. Codex followed the planted instruction on the first try more than 90% of the time, and Claude Code about half the time. The post gives no sample size, model versions or test setup. The quoted source is a Cyber Security News post from October 26, relayed by a Japanese security account.

The post cites a second, unrelated incident from February. A poisoned GitHub Actions cache let an attacker push a malicious Cline release to roughly 4,000 machines. It used no markdown trick, only an unmonitored trust chain.

How to use it

Campfire is self-hosted and runs Claude Code, Codex, Goose, Aider and OpenHands in one tab. Risky actions need a majority vote, a single deny blocks them, and a 30 second timer ends the wait. Session replay records which file or tool call triggered each action. The stated run command:

bunx the-campfire

The repository link is truncated on the page (github.com/stretchcloud/c…), so the full repo name is not shown.

Limits

The post shows no evidence that Campfire's voting would have blocked the AGENTS.md attack. It does not say what counts as a "risky action," how votes are cast or by whom, or what happens when the 30 second timer expires: approve, deny or skip. No licence is stated. The attack figures come from a third-party report, quoted secondhand without methodology. The author of Campfire is also the author of the post.