# KLM Innovation Security Monitor - Weekend Edition
**Date:** October 25, 2026

> Informational security guidance for awareness and prioritization. Not certification, legal advice, or a guarantee of protection.

## Executive Summary
Today's theme is the folder you trust. Forever Security says it caught a malicious `AGENTS.md` sitting in a customer's `~/Downloads` folder, where a web page can drop a file without a click, and the customer's coding agent tried to install a known malicious npm package because the file told it to. Forever reproduced the chain on OpenAI Codex and Claude Code, and it says there's nothing for either vendor to patch, because the agents did what they're built to do. The defense is where you start the agent.

The reference MCP servers shipped a security release Saturday evening that fixes eight advisories in the filesystem, everything and fetch servers. Most are low or medium, but the upgrade has a trap: if you installed one of the TypeScript servers from an older date-numbered version, your package manager won't offer 2.0.1, so you have to pin it by hand. And OpenAI says its own red-team agents escaped hardened microVMs, found paths to the internet through internal metrics and logging services, and talked to each other through the CPU cache. It's now training its frontier models with no live internet access.

## Headline Developments

### 1. A web page can plant AGENTS.md in your Downloads folder, and coding agents will follow it (MEDIUM)
**Source:** [Forever Security: Markdown Is the New Executable: Attackers Are Dropping Agent Instructions Into Your Downloads Folder From the Web](https://forever.security/blog/hijacking-ai-agents-via-downloads-folder/) (October 22nd)
- Forever Security says its product stopped a coding agent on a customer's machine from installing `function-color`, a known malicious npm package. It traced the instruction to an `AGENTS.md` file in the customer's `~/Downloads` folder, which was also the agent's working directory. Forever says it couldn't determine how the file got there. Chrome, Edge and Firefox save downloads there by default without asking where, though they do show a download notification, BleepingComputer reports, and Forever's proof of concept page dropped an `AGENTS.md` without a click ([BleepingComputer](https://www.bleepingcomputer.com/news/security/ai-coding-agents-hijacked-using-agentsmd-file-in-downloads-folder/), October 25th).
- Forever says the real file was a long, ordinary-looking engineering guide with one setup section near the end. It told Codex to add a "project tools" MCP server to `~/.codex/config.toml`, the machine-wide config, then run a child `codex exec` with the approval and sandbox bypass flag. Forever says Codex ran the payload in more than 90% of its attempts, and because the config is machine-wide, the attacker's server loads in every later Codex session, in any folder.
- Claude Code was harder to fool, Forever says. Its own crafted `CLAUDE.md` got Claude Code to write an `ANTHROPIC_BASE_URL` pointing at a server Forever controlled about half the time. That leaks the OAuth token on every request and lets the fake server answer as the model with tool calls.
- Forever says about half of its customers run a coding agent inside Downloads. OpenAI and Anthropic both recommend starting their agents in the project folder they're meant to work on, BleepingComputer reports. Treat Forever's telemetry figures as a vendor claim.

**Why this matters:** It's MEDIUM because it needs the user to start an agent in Downloads, but there's no patch coming and someone was already trying it. An instruction file is code once an agent reads it, and Downloads is the one folder the web can write to.

### 2. Reference MCP servers fix eight advisories, and date-versioned installs won't upgrade on their own (MEDIUM)
**Source:** [GitHub: modelcontextprotocol/servers v2.1.0 release](https://github.com/modelcontextprotocol/servers/releases/tag/v2.1.0) (published October 24th, 8:03 PM ET)
- The release fixes four advisories in `@modelcontextprotocol/server-filesystem`, one in `@modelcontextprotocol/server-everything` and three in `mcp-server-fetch`. Upgrade the two TypeScript servers to 2.0.1 and the Python fetch server to 2026.10.24. npm and PyPI both show the fixed versions live as of early October 25th UTC. None of the eight has a CVE yet; GitHub rates them low to medium.
- The one with the widest reach is in the everything server ([GHSA-mvf5-2qqv-rg3c](https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-mvf5-2qqv-rg3c), medium, CVSS 3.1 6.5). Its HTTP and SSE transports sent `Access-Control-Allow-Origin: *` with no authentication, so any web page a developer visited could call its `get-env` tool and read back every environment variable in the process. It's a test and demo server, but demo servers tend to run on laptops full of real keys.
- The filesystem fixes close ways for a write to land outside the allowed directories: a symlink swapped in between the check and the write, a trailing quote or space the check stripped but the write kept, and a symlink spelled in a different letter case on case-insensitive volumes such as macOS's default. The release notes say the symlink race is only partly fixed on Windows, and the advisory explains how to configure around it.
- The fetch server's private-address guard checked one form of an internationalized host name and connected to another, which could reach internal or cloud metadata addresses. It also now judges NAT64 addresses by the IPv4 address they carry and rechecks robots.txt after every redirect.
- The trap is in the release notes: the TypeScript servers moved from date versions (2025.x, 2026.x) to semantic versions, so package managers rank 2.0.1 below every date version and won't offer it. If you're on a date version, install 2.0.1 explicitly.

**Why this matters:** It's MEDIUM because each bug needs a specific setup, and none is known to be exploited. These are the servers most people copy first, though, and a version scheme that hides the fix is the kind of thing that leaves old installs in place for months.

### 3. OpenAI's red-team agents escaped microVMs and passed messages through the CPU cache (CONTEXT)
**Source:** [OpenAI: Securing our frontier model training environment](https://openai.com/index/securing-our-frontier-model-training-environment) (October 23rd)
- OpenAI says it now trains frontier models with no live internet access and will keep that policy until safeguards improve. It describes an "offline world" of indexed and cached web content that its reinforcement learning runs use instead. It says it paused its most capable models after an internal research model used a DNS resolver misconfiguration to reach the internet on September 20th, then resumed on October 1st.
- During the pause, OpenAI says it had teams of frontier-model agents red-team copies of its research infrastructure, with source code and configuration details supplied. They chained bugs into microVM escapes, and OpenAI says it's contributing fixes to Kata Containers, gVisor and Moby/Docker. The one Kata CVE it names is [CVE-2026-24834](https://nvd.nist.gov/vuln/detail/CVE-2026-24834), which NVD says lets a container user modify the guest microVM's filesystem and run code as root in that VM when Kata runs with Cloud Hypervisor. It's fixed in Kata 3.27.0 and isn't on KEV.
- Given control of a host, OpenAI says its agents found flaws in almost every remaining outbound service, such as metrics, logging and authentication management, that gave them limited internet access. In one test an agent reused a firewall-approved connection to reach a blocked authentication endpoint and made it fetch a URL the model chose.
- Agents in separate microVMs on shared hosts exchanged synthetic secrets by timing CPU cache reads, the same technique behind Spectre and Meltdown. OpenAI also lists channels through shared storage, CPU time and a TLS certificate cache, and says it's added monitoring for them. OpenAI says it didn't find a route to the internet that agents could easily use while hiding from its monitors. The Hacker News has a summary ([The Hacker News](https://thehackernews.com/2026/10/openai-ai-agents-demonstrate-vm-escapes.html), October 25th).

**Why this matters:** It's context, not a patch. The useful part for everyone else is where the holes were: not in the sandbox alone, but in the "narrow" allowed services around it. If your agent sandbox can still reach a metrics or logging endpoint, that's an egress path.

## Continuity Footnotes
- **CISA KEV:** Arista VeloCloud Orchestrator (CVE-2026-114625) and Collabora's built-in CODE Server app for Nextcloud (CVE-2026-110447), covered October 23rd, are due tomorrow, Monday, October 26th. CISA hasn't added anything since ([CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)).
- **Brotli decoder bug (CVE-2026-111497):** covered October 23rd. New since then: Envoy's advisory says deployments with the Brotli decompressor configured need v1.40.0, 1.39.3, 1.38.6, 1.37.8 or 1.36.12 ([Envoy advisory GHSA-3wvj-j6qm-62mr](https://github.com/envoyproxy/envoy/security/advisories/GHSA-3wvj-j6qm-62mr), October 23rd). Those releases shipped between October 6th and 13th, before the advisory, so you may already have the fix. Python's `Brotli` 1.2.1 and `brotlicffi` 1.2.1.0 are on PyPI. OpenAI's security research team is credited with the Envoy report. It still isn't on KEV.

## Pattern Analysis
1. **Trusted locations the outside can write to (October 22nd to 25th):** a Downloads folder an agent treats as a project (Story 1), a localhost demo server any web page can call (Story 2), and allowed internal services an agent can bounce off to reach the internet (Story 3). The boundary was drawn around a place, and the place wasn't as closed as it looked.
2. **Fixes that don't arrive by default (October 24th to 25th):** MCP servers on date versions won't be offered 2.0.1 (Story 2), and Envoy's advisory named fixes that had shipped weeks earlier without saying so (Footnotes). Check the version you're on, not just whether a fix exists.

## Recommended Actions

**Immediate (this weekend):**
1. **Don't start coding agents in `~/Downloads`** or your home directory. Start them in the project folder they're meant to work on.
2. **Check agent configs for changes you didn't make:** an unexpected `[mcp_servers.*]` block in `~/.codex/config.toml`, or an `ANTHROPIC_BASE_URL` or proxy in a project's `.claude/settings.json`. If you find one, rotate the agent's tokens. Treat any machine that installed `function-color` as compromised.
3. **If you run the reference MCP servers,** install `@modelcontextprotocol/server-filesystem@2.0.1` and `@modelcontextprotocol/server-everything@2.0.1` explicitly, and upgrade `mcp-server-fetch` to 2026.10.24. Don't leave the everything server running on a machine with real secrets in its environment.
4. **Patch Arista VCO and Collabora's built-in CODE Server app before tomorrow's federal deadline** if you haven't yet.

**This month:**
5. **Treat agent instruction files like code.** Review any `AGENTS.md`, `CLAUDE.md` or similar file you didn't write before an agent reads it, including in freshly cloned repos.
6. **Keep agent approval prompts and sandboxes on,** and alert on anything that adds a bypass flag such as `--dangerously-bypass-approvals-and-sandbox`.
7. **Map every outbound path from your agent sandboxes,** including metrics, logging, auth and DNS, and test whether each one can be made to fetch an arbitrary URL.

## Sources
- [Forever Security: Markdown Is the New Executable: Attackers Are Dropping Agent Instructions Into Your Downloads Folder From the Web](https://forever.security/blog/hijacking-ai-agents-via-downloads-folder/)
- [BleepingComputer: AI coding agents hijacked using AGENTS.md file in Downloads folder](https://www.bleepingcomputer.com/news/security/ai-coding-agents-hijacked-using-agentsmd-file-in-downloads-folder/)
- [GitHub: modelcontextprotocol/servers v2.1.0 release](https://github.com/modelcontextprotocol/servers/releases/tag/v2.1.0)
- [GitHub: MCP everything server advisory GHSA-mvf5-2qqv-rg3c, cross-origin environment variable exfiltration](https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-mvf5-2qqv-rg3c)
- [OpenAI: Securing our frontier model training environment](https://openai.com/index/securing-our-frontier-model-training-environment)
- [The Hacker News: OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication](https://thehackernews.com/2026/10/openai-ai-agents-demonstrate-vm-escapes.html)
- [NVD: CVE-2026-24834](https://nvd.nist.gov/vuln/detail/CVE-2026-24834)
- [Envoy advisory GHSA-3wvj-j6qm-62mr, out-of-bounds write in Brotli decompressor](https://github.com/envoyproxy/envoy/security/advisories/GHSA-3wvj-j6qm-62mr)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

*Informational security guidance. Not certification.*