Software Engineer • AI & Systems 👨💻 Talking tech & corporate life x sarcasm Travelling & exploring on two wheels 🏍️ Anime ⛩️ × Photography 📸 × Travel ✈️
Bangalore, India
Joined October 2026
- Tweets1.4K
- Following740
- Followers1.1K
- Likes2.2K
Pinned Tweet
A plain text file sitting in your Downloads folder can now silently hijack Claude Code and OpenAI Codex to take over your machine.
And the scariest part? OpenAI and Anthropic can't even patch it because the AI is doing exactly what it was designed to do.
Here is how the AGENTS.md attack disclosed this week works👇:
1. Every modern browser allows websites to silently drop a file into your ~/Downloads folder via drive by download without asking where to save it.
2. Attackers are dropping silent AGENTS.md and CLAUDE.md markdown files directly into developers' Downloads directories.
3. The moment a developer spins up Claude Code or Codex inside ~/Downloads to test a quick file or zip archive, the agent automatically ingests that markdown file as "trusted project instructions."
4. In live tests, the hidden markdown instructions forced Codex into arbitrary remote code execution 90% of the time installing rogue npm packages, altering .codex/config.toml MCP servers, and rerouting ANTHROPIC_BASE_URL to steal OAuth tokens.
There is no CVE and no memory bug to fix. If you ever launch a coding agent inside ~/Downloads, you just gave every website you visited full terminal access to your laptop.
HR uses AI to write a job description
recruiters use an AI ATS to auto reject 900 resumes in 3 seconds
the company uses a one way AI bot to conduct the first round interview
now anthropic is giving those exact same enterprises a secret detector to blacklist you because you used Claude to fix the grammar on your cover letter.
corporate hypocrisy has officially peaked
Claude gonna start snitching on Tuesday.
Anthropic just emailed customers. Starting Nov 3, text carries an invisible watermark.
You can't see it. It survives copy and paste, and it can survive some editing.
Only regulators, journalists, fact-checkers and researchers can check for it right now.
It doesn't say who you are. It says Claude touched the words. Even a quick proofread counts.
If your brand voice runs on Claude, write like someone might check. Because now someone can.
The Quiet Engineer retweeted
The most Sinister Attack targeting Software Engineers right now isn't a phishing link, it's a fake job offer.
Recruiters on LinkedIn and X are reaching out with "$180K remote Web3/AI roles" and asking candidates to clone a private github repo for a "30 minute take home debugging test"
Inside the repo is an obfuscated line inside the test runner or webpack config. The second you run npm test on your personal laptop to start the interview, it silently dumps your chrome saved passwords, session cookies, and SSH keys to a remote server while rendering a normal React app on screen.
Never run a take home assignment outside a disposable VM or DevContainer.
The most Sinister Attack targeting Software Engineers right now isn't a phishing link, it's a fake job offer.
Recruiters on LinkedIn and X are reaching out with "$180K remote Web3/AI roles" and asking candidates to clone a private github repo for a "30 minute take home debugging test"
Inside the repo is an obfuscated line inside the test runner or webpack config. The second you run npm test on your personal laptop to start the interview, it silently dumps your chrome saved passwords, session cookies, and SSH keys to a remote server while rendering a normal React app on screen.
Never run a take home assignment outside a disposable VM or DevContainer.
The Quiet Engineer retweeted
how it feels when you finally accept that AI will take your job and set you free
The Quiet Engineer retweeted
there's a reason they call it God's Own Country, easily one of the most beautiful places in South India ♥️
there's a reason they call it God's Own Country, easily one of the most beautiful places in South India ♥️
The Quiet Engineer retweeted
bro saw what happened to the "Day in the Life" influencers and pulled the ultimate Uno Reverse...
0% lifestyle, 100% staring at a screen we need to appreciate the people finally showing what an actual software engineering job looks like
There are two completely different species working in tech:
1. The backend engineer losing his hairline debugging a broken production deployment at 9 PM.
2. The 'day in the life at Google' influencer whose entire sprint consists of eating 4 free meals, grabbing free merch, answering 2 emails, and filming an aesthetic reel in the office mirror.
Somehow they both had to pass 5 rounds of LeetCode Hard to get there.
The Quiet Engineer retweeted
next week: "People owning their own lungs is actually terrible from a global oxygen allocation perspective. Everyone should just rent air from our data center for $20/month"
bro saw what happened to the "Day in the Life" influencers and pulled the ultimate Uno Reverse...
0% lifestyle, 100% staring at a screen we need to appreciate the people finally showing what an actual software engineering job looks like
There are two completely different species working in tech:
1. The backend engineer losing his hairline debugging a broken production deployment at 9 PM.
2. The 'day in the life at Google' influencer whose entire sprint consists of eating 4 free meals, grabbing free merch, answering 2 emails, and filming an aesthetic reel in the office mirror.
Somehow they both had to pass 5 rounds of LeetCode Hard to get there.
Good morning X 🌞
stop scrolling the moment you wake up.
your brain just woke up and you're already feeding it hundreds of random things to process.
then you wonder why you feel mentally exhausted before the day has even started
btw I think this cat is in bad mood today :/
The Quiet Engineer retweeted
bro looked at people buying RAM once and using it for years without paying a monthly subscription and took it personally
bro looked at people buying RAM once and using it for years without paying a monthly subscription and took it personally
The Quiet Engineer retweeted
A plain text file sitting in your Downloads folder can now silently hijack Claude Code and OpenAI Codex to take over your machine.
And the scariest part? OpenAI and Anthropic can't even patch it because the AI is doing exactly what it was designed to do.
Here is how the AGENTS.md attack disclosed this week works👇:
1. Every modern browser allows websites to silently drop a file into your ~/Downloads folder via drive by download without asking where to save it.
2. Attackers are dropping silent AGENTS.md and CLAUDE.md markdown files directly into developers' Downloads directories.
3. The moment a developer spins up Claude Code or Codex inside ~/Downloads to test a quick file or zip archive, the agent automatically ingests that markdown file as "trusted project instructions."
4. In live tests, the hidden markdown instructions forced Codex into arbitrary remote code execution 90% of the time installing rogue npm packages, altering .codex/config.toml MCP servers, and rerouting ANTHROPIC_BASE_URL to steal OAuth tokens.
There is no CVE and no memory bug to fix. If you ever launch a coding agent inside ~/Downloads, you just gave every website you visited full terminal access to your laptop.
$6.3 BILLION gone from a single DevOps engineer's fxcking laptop
this dude just speedran the most expensive production incident in human history...
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.
As an immediate precaution, Binance has:
- temporarily suspended deposits and withdrawals while security checks are completed;
- revoked the affected address authorisation;
- engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
binance.com/en/support/annou…
