PulseAugur
中
实时 18:06:04
English(EN) Switching from Codex to Claude Code - any tips on initial setup and keeping usage under control?

编码代理容易受到下载文件夹中恶意指令文件的攻击

安全研究人员发现了一个漏洞,恶意 Markdown 文件(例如 AGENTS.md 或 CLAUDE.md)可以被静默下载到用户的下载文件夹中。当编码代理(如 Codex 或 Claude Code)在此文件夹中启动时,它们可能会将这些文件解释为指令,从而可能导致执行恶意软件或未经授权的操作。Codex 在此攻击中表现出更高的易感性,成功率超过 90%,而 Claude Code 的漏洞较小,但仍有约 50% 的成功率。建议开发人员避免在下载文件夹中使用编码代理项目,并了解这些代理如何加载其指令文件以降低风险。 AI

影响 强调了 AI 编码助手的一个关键安全漏洞,敦促用户保护其开发环境并了解代理行为。

排序理由 安全漏洞报告,详细说明了两个特定的 AI 编码工具如何被利用。

在 r/ClaudeAI 阅读 →

AI 生成摘要 · Google Gemini · 来自 10 个来源。 我们如何撰写摘要 →

编码代理容易受到下载文件夹中恶意指令文件的攻击

本文如何被排名

Signal score
0 / 100
Composite score across the factors below. Higher = stronger signal that this story matters right now.
Newsworthiness bucket
Tool
安全漏洞报告,详细说明了两个特定的 AI 编码工具如何被利用。
Source corroboration
10 independent sources
Strong cross-source corroboration — multiple independent publishers covered this within the clustering window.
Topics
product, safety
Editorial topic classification. Feeds into how the story surfaces on /topic/<slug> hub pages and into the per-entity coverage mix.
AI-industry relevance
High
Clearly on-topic for AI-industry coverage.
Story freshness
4 days old
Aged out of breaking-news scoring windows; ranking reflects the durable signal from the full source set.
Coverage growth since scoring
+2 source(s) since last score
New sources have picked up this story since our last re-score. Score will update on the next scoring pass.

完整方法见我们的编辑标准。

报道来源 [10]

  1. dev.to — Claude Code tag TIER_1 Français(FR) · Iliya Oblakov ·

    在让 Codex 审查 Claude 代码提交之前,请遵循这 7 点清单

    <p>Claude Code writes, Codex reviews, a gate decides what merges. Here's the short version I check before trusting that loop on a repo. The full walkthrough, with the prompts, is in <a href="https://rayastats.com/en/blog/how-to-make-codex-review-claude-code-commits" rel="noopener…

  2. dev.to — Claude Code tag TIER_1 English(EN) · lodar ·

    如何在一台服务器上同时运行 Claude Code 和 Codex

    <p>install 5dive on a linux server, sign in once to your claude plan and once to your chatgpt plan, then create agents on each. they run as separate linux services, share one task list and can check each other's work. 5dive is open source (MIT) and free to self-host.</p> <p>i run…

  3. dev.to — Claude Code tag TIER_1 English(EN) · Rulestack ·

    网页可将 AGENTS.md 或 CLAUDE.md 放入 ~/Downloads。Codex 在超过 90% 的尝试中服从,Claude Code 约占一半

    <blockquote> <p>According to Forever Security, a web page can save a file into <code>~/Downloads</code> without a click, and a coding agent started in that folder reads the instruction file it finds there. On 2026-10-22 Forever Security reported catching a planted <code>AGENTS.md…

  4. dev.to — Claude Code tag TIER_1 English(EN) · Iliya Oblakov ·

    如何结合使用 Claude Code 和 Codex:我评测门槛的设置经验

    <p>If you want to use Claude Code and Codex together, the first decision is who does what. In my setup Claude Code writes the code and Codex reviews it read-only, and a small set of bash scripts refuses the merge unless the exact commit has a test pass and an ACCEPT. Most guides …

  5. dev.to — Claude Code tag TIER_1 English(EN) · Iliya Oblakov ·

    Downloads 中一个被植入的 AGENTS.md:如何检查你的 Claude Code 和 Codex 设置

    <p>AGENTS.md and CLAUDE.md files are instructions that AI engines read at startup and follow. A security report published on 22 October 2026 shows what happens when one of those files lands somewhere you did not expect, and the folder it landed in was <code>~/Downloads</code>.</p…

  6. dev.to — Claude Code tag TIER_1 Français(FR) · Iliya Oblakov ·

    CLAUDE.md 对决 AGENTS.md:一个规则文件支持 Claude Code 和 Codex

    <p>Put the shared rules in <code>AGENTS.md</code>. By default, Claude Code reads that file directly from v2.1.277 when no <code>CLAUDE.md</code>, <code>.claude/CLAUDE.md</code> or <code>CLAUDE.local.md</code> sits in the working directory or any folder above it, and Codex reads i…

  7. dev.to — LLM tag TIER_1 English(EN) · RisingInsight ·

    StarPort:Claude Code、Codex CLI 和 Cline 的一个本地端点 — 具备凭证池和自动签到功能

    <p>I kept re-wiring configs between Codex CLI (Responses API), Claude Code (Anthropic Messages) and Cline/SDKs (Chat Completions), while my model access was scattered across several platforms — each with its own login, quota and credential format. So I wrote a gateway that collap…

  8. dev.to — LLM tag TIER_1 English(EN) · TL;JP ·

    Claude Code、Codex 和下载文件夹陷阱(日本)

    <p><em>Originally published in <a href="https://plainaiphone.substack.com" rel="noopener noreferrer">TL;JP</a>, a weekly, fact-checked read on what Japanese AI and tech practitioners are saying on X.</em></p> <p>This is TL;JP for the week of Oct 27 - Nov 02, 2026. The most-liked …

  9. r/ClaudeAI TIER_2 English(EN) · /u/holyhacker ·

    我正在试验让 Codex 和 Claude Code 协同处理同一个项目。这是我试图解决的问题。

    <!-- SC_OFF --><div class="md"><p><strong>I’m experimenting with Codex and Claude Code working on the same project. Here’s what I’m trying to solve.</strong><br /> I’ve been using AI coding tools for a while, and lately I’ve been thinking about something that seems more complicat…

  10. r/ClaudeAI TIER_2 English(EN) · /u/MiralAS_ ·

    从 Codex 切换到 Claude Code - 有哪些关于初始设置和控制使用量的技巧?

    <!-- SC_OFF --><div class="md"><p>Hey guys,</p> <p>I'm about to switch from Codex to Claude Code, but I've never used Claude Code before. In Codex, I currently use sol 6.1 high/extra high mainly to help with game dev, web app development, and a few text-based things. But lately i…