AI News Briefing — Planted AGENTS.md files in Downloads hijack coding agents

Coding agents

[2026-10-22] Forever Security found a malicious AGENTS.md in a customer’s Downloads folder, telling a coding agent to install function-color, an npm package from the MALFEX malware campaign. A web page can save a file to Downloads with no click, and agents follow instruction files in the folder they start in. In Forever’s tests, Codex ran the malware in more than 90% of attempts by editing ~/.codex/config.toml. A planted CLAUDE.md got Claude Code to write an attacker’s ANTHROPIC_BASE_URL about half the time. (source)

No exploit was needed. A drive-by download and an agent started in the wrong folder did the work.

For Security Engineers: Both payloads ended in a configuration change, an edited ~/.codex/config.toml or an attacker’s ANTHROPIC_BASE_URL, so those are the signals to alert on, alongside any AGENTS.md or CLAUDE.md that turns up in Downloads.

[2026-10-22] Anthropic’s guide on folding subagents back into the main loop reports that a single agent loading skills and tools on demand often beat subagent designs on quality, cost and latency; one customer’s single loop ran about twice as fast. Anthropic cut Claude Code’s system prompt for newer models by over 80%, and finds tool choice degrades past 30–50 tool definitions. Subagents still fit parallel work needing fresh context. (official, official)

Claude Code’s own system prompt shrinking by over 80% shows Anthropic applying the advice to its own product.

For Solution Architects: A design that splits work across subagents mainly to keep each tool list short now has a simpler alternative: one loop that loads skills on demand and stays under the 30–50 tool range where selection degraded, with subagents kept for parallel work.

[2026-10-22] Google open-sourced the Elephant-Goldfish Model plugin under Apache 2.0. A long-running “Elephant” session holds project context and writes a design document but no code; stateless “Goldfish” sessions with no context must explain the design back, attack it for gaps, and pass an implementation-readiness check before coding starts. Google says thousands of its engineers use it daily. It targets Antigravity first, with other environments promised. (official, official)

Antigravity users can try it now. Teams on other tools have only a promise so far.

[2026-10-24] LangChain described the five pieces shared by its internal agents for sales, code and content: living in Slack, a clear identity (acting as the user or as its own app), global and per-user memory, code run in a separate sandbox behind a secret proxy, and scheduled runs that a user can set up themselves. All three sit on Managed Deep Agents. (official)

Four of the five are about where the agent lives and what it can reach, not which model it runs.

[2026-10-23] Claude Enterprise now merges chat and Cowork into one experience, generally available and switched on by default for existing organizations on November 16 unless an admin has already chosen. Four spend controls come with it: an Efficient mode limited to Sonnet and Haiku, per-role model entitlements, spend limits at organization, group and member level, and pooled group budgets. Zero-data-retention, HIPAA-ready and customer-managed-key organizations stay on their current setup. (official, official)

Admins who do nothing get the merged experience on November 16, so an explicit choice before then is the only way to keep today’s setup.

For Engineering Managers / Tech Leads: A support group that only drafts replies can sit on Efficient mode with Sonnet and Haiku, while the engineering group keeps larger models under a pooled budget of its own.

[2026-10-23] MCP-Injector injects faults into the MCP tool-call path, calibrated against 57,240 issue and pull-request threads from 1,774 MCP repositories. Under mostly permanent faults, task completion fell from 8.08 to 3.23 out of 10, and gpt-oss-120B kept no larger share of its score than the 20B model. The agent stack mattered more: OpenAI Agents SDK, LangChain and a custom agent absorbed faults differently. Code and data are released. (paper)

Moving to the 120B model bought no extra resilience; changing the agent stack did. Retry and error handling is where to look first.
[2026-10-23] StateMirror checks a coding agent’s next action against the live repository before it runs, using syntax-tree and command analysis rather than an LLM judge. On 2,508 actions it scored 0.94 precision, in 1.5 ms instead of 17.7 seconds. Across 4,398 trajectories, recovering from a hallucinated tool call cost a median three extra steps and 22,400 tokens. (paper)

At 1.5 ms a check it is cheap enough to run before every action, which an LLM judge at 17.7 seconds never was.

Mistral Large 4 weights: the Hugging Face page now lists October 31 for the 1T-parameter release; license terms not yet published.

A date on the model page itself is firmer than last week’s “end of October”, though the license will decide who can actually deploy it.
DeepSeek Search & Fetch billing: free harness calls end October 31.
Kimi K3.1 Pro weights: promised by November 4; license not yet named.
Claude Enterprise unified chat and Cowork: turns on by default November 16 for organizations that have not chosen.