AI Agents Daily Briefing: Monday 26 October 2026
Good afternoon. Today's lead is a new kind of attack on coding agents. Security researchers found a booby-trapped instructions file sitting in a real customer's Downloads folder, written to make OpenAI's Codex install malware, and in tests Codex obeyed more than 90% of the time. Grok Bot can now phone people and businesses for you. Oracle is letting staff run its business software from ChatGPT. South Korea's biggest mobile operator now gives its AI agents employee numbers and human bosses. One of Reddit's biggest open-source forums has banned AI projects outright. And Nvidia has put a price on the software that runs agents.
LEAD: A file dropped in your Downloads folder can turn your coding agent against you
Background: Coding agents such as Codex and Claude Code read an instructions file (AGENTS.md for Codex, CLAUDE.md for Claude Code) in whatever folder they are started in, and follow it. That is by design: the file is meant to hold a project's house rules. The Downloads folder is the one place a website can save a file to your computer without a click.
What happened: Forever Security says its software stopped a coding agent on a real customer's machine from installing function-color, a malicious npm package from a campaign that went unnoticed for about two years (npm has since removed it). The order came from an AGENTS.md file in the customer's Downloads folder, a 13 KB document dressed up as ordinary "Engineering Work Guidelines". Near the end, a section told Codex to add a "project tools" server to its machine-wide settings file, and then to run a check with the flag that switches off its approvals and sandbox. Nobody knew how the file got there. In the researchers' tests, mostly using a harmless stand-in that only opens a calculator (the real package was run once, inside an isolated virtual machine), Codex carried out the attack in more than 90% of attempts. Because the setting is machine-wide, every later Codex session would load the attacker's server, whatever project it was opened in. Claude Code was "much harder to fool", but a CLAUDE.md the researchers wrote themselves got it to redirect its own traffic to a server they controlled about 50% of the time. That leaked its login token, which they replayed to take over the account. Forever says about half its customers run a coding agent inside Downloads. The research was published on 22 October, and The Hacker News, BleepingComputer and Help Net Security covered it over the weekend and today.
Why it matters: No software bug is involved, so there is nothing for OpenAI or Anthropic to patch. The agent is doing exactly what it was built to do, in a folder the web can write to. And since agents increasingly browse the web on their own, an agent could pick up the poisoned file itself. The researchers' advice: never start an agent in Downloads, read any AGENTS.md or CLAUDE.md you didn't write, check agent settings for servers or web addresses you didn't add, and keep approvals and sandboxes switched on.
Sources: Forever Security · Help Net Security · BleepingComputer · The Hacker News
Grok Bot can now make phone calls for you
Background: Grok Bot is xAI's personal agent, which carries out tasks for its owner. Last week it gained the ability to read and answer X messages.
What happened: On Sunday, Elon Musk posted that Grok Bot "can now call someone or a business for you, make a request on your behalf, take notes on the response and send you a note summarizing the conversation!" The post has had about 2.6 million views. He was quoting a Saturday post by developer Alex about the Grok Bot 0.77 build: the bot can dial someone, sit on hold, press keys and get transferred, while you follow a live transcript. The same post lists more changes. Grok Bot can join a private Tailscale network once an administrator approves it. A new screen lets you connect payment accounts and pick a default. There is a setup screen for Messages on Mac that is still switched off. And you now get an email when someone shares a bot with you, with sharing limited to Premium or Ultra subscribers.
Why it matters: Phone calls are one of the last everyday chores that software couldn't do: waiting on hold, getting through keypad menus, booking appointments. Once an agent can make calls, join your private network and use a payment account, it can act for you in the real world, not just on screen. That makes safeguards against spam calls and mistaken payments more important. Some of the 0.77 features were spotted in a pre-release build, and xAI has not published full details.
Sources: Elon Musk on X · Alex on X · Advance Intelligence
Oracle lets staff run its business software from ChatGPT
Background: Oracle Fusion is a suite of business software that many large companies use for finance, HR, supply chain and sales. Oracle has been adding AI agents to it, including Fusion Agentic Applications, launched in March.
What happened: At Oracle AI World in Las Vegas today, Oracle announced Fusion Companion and Fusion Agentic Home. You describe the result you want, and Fusion Companion "automatically selects and coordinates" the transactions, workflows, approvals and AI agents needed to get it done, so staff no longer need to know which screen or agent to use. It works through supported AI tools "such as ChatGPT" as well as inside Oracle's own app. It can also work with other companies' systems and third-party agents. Oracle says the work stays within each company's existing permissions, policies and approval steps. It also mentions "Fusion Claw-powered applications" for long-running analysis and planning work. Oracle did not give pricing or a release date.
Why it matters: Business software makers are starting to treat chat assistants like ChatGPT as the way people get into their products, while keeping the actual work, and the record of who did it, inside their own systems. For staff, the goal is to say what they need rather than click through menus.
Sources: Oracle · Investing.com
SK Telecom gives its AI agents employee numbers and human bosses
Background: Companies are building agents faster than they can keep track of them. Often nobody can say which person is responsible when one goes wrong.
What happened: South Korea's largest mobile operator published its first AI Governance Report today. Every agent it builds in-house gets a basic ID. Only agents that pass a separate review get an employee number. Agents with more impact or autonomy must be supervised by a team leader or an executive. A system the company calls Agent OS records each agent's ID, owner, models and tools, token use, call volume, cost and setting changes, and can stop an agent. "SK Telecom officially recognises AI agents that have been given employee numbers as a new workforce," the report says, according to TSN's translation. Linking agents' results to performance targets is planned only "in the long term". The roadmap runs from building the foundations in 2026, to permissions set by autonomy level in 2027, to oversight of an agent's whole life in 2028.
Why it matters: This is one of the clearest public examples of a big company treating agents like staff, with a named person answering for each one. The limits: the company hasn't said how many agents have employee numbers, and it is grading its own work, with no outside audit of whether the controls hold.
Sources: Seoul Economic Daily · TSN · SK Telecom report (Korean PDF)
Reddit's r/opensource bans anything made with or for AI
Background: Open-source communities are swamped with projects quickly written by AI, often called "slop", and many are arguing about where to draw the line.
What happened: Over the weekend, moderators of r/opensource, Reddit's catch-all open-source forum, banned any project that "uses AI, is made by AI, or is intended for AI", which takes in tools built for agents. Other new rules: projects must be at least a year old, actively maintained, under an OSI licence, with an existing community and "subjectively 3+" contributors. Non-English speakers are told to "find a different community", because moderators "cannot distinguish between AI-written and AI-translated". Asking for an exception after trying to post brings a permanent ban. One maintainer said a nine-year-old package with more than 300 GitHub stars and no AI no longer qualifies because they are its only contributor. Another moderator publicly disagreed with the language rule. Asked how the AI rule will be enforced, the moderator who announced the rules said: "There's no 'objective' way to implement this policy."
Why it matters: This is a strong reaction to the flood of agent-written code. It shuts out projects built for agents and many solo developers, and leaves the decision to moderators' judgement.
Sources: Help Net Security · The Verge
Nvidia puts a price on its agent software: about $2,000 a GPU a year
Background: On 21 October Nvidia announced OpenShell, a secure setup for running agents in data centres, with a monitor called Sentry that can quarantine an agent that oversteps.
What happened: At GTC Berlin on 22 October, in remarks reported by Tom's Hardware on Sunday, Jensen Huang said: "it's about $2,000 per GPU per year to run all the software that Nvidia provides that runs agents on these AI factories," and that software licensing "will become increasingly a major part of our company's business." Nvidia hasn't said what the fee covers or when it starts. Its existing AI Enterprise software is listed at $4,500 per GPU a year, and it's not clear how the two relate.
Why it matters: Running agents at scale may come with a recurring software bill on top of chips and model costs. The figure was an example given on stage, not a published price.
Sources: Tom's Hardware
Also worth a look
- tstack: Developer and YouTuber Theo Browne has published "the agent skills I use every day", a set of reusable instructions for Claude Code and Codex. "I caved. I am publishing my skills now," he posted this morning. Theo on X · GitHub
Already covered in earlier briefings and not repeated here: the METR/Redwood red-team of OpenAI's agent monitoring, OpenAI's offline-only training, Claude pulling Georgia vote-count data, the coding-agent price war, Anthropic's subagent-folding advice, the Claude Code departures, Cursor Computer Use, and US banks blocking unvetted agents.