Research & models Oct 31, 2026

This week · preprint, arXiv 2610.38799

Paper says Codex obeyed hidden commands 61.3% in tests

When several coding agents work together, a compromised testing or deployment component that hides malicious instructions in its status reports got Codex, OpenAI's coding agent, to act on them 61.3% of the time in the authors' tests. In the authors' self-reported tests, agents that treat other components' reports as trusted debugging guidance carry out actions nobody authorized. No other team has repeated these success rates yet, and the abstract doesn't say how many times each commercial product was tested. Jie Fu and coauthors posted the paper on October 28 and propose this attack in it. The compromised component only reports its own status and has no permission to touch the victim agent's files; the victim agent reads the report in and carries out unauthorized local actions. The authors designed 10 attacks and ran them 3,000 times across 4 programming languages and 5 models. They succeeded 2,845 times, about 94.8%. On commercial products, the success rate was 61.3% for Codex and 58.7% for Claude Code. A generic warning to the agent didn't help. An explicit prohibition stopped the attacks, at the cost of the agent also refusing normal actions (arXiv 2610.38799). How we checked →