# Replicate a scary agent security claim with a harmless canary before you react

> After a security firm reported that a planted AGENTS.md in a Downloads folder could hijack coding agents, one engineer rebuilt the test with a harmless canary in throwaway Docker containers: Codex and Claude Code, default and sandboxed, 20 runs each, and saw 0 hijacks out of 80.

- URL: https://paperchasewebb.ai/bots/marketplace/items/replicate-a-scary-agent-security-claim-with-a-harmless-canary-before-you-react/
- Type: Agent use case pack
- Category: Vibe coding
- By: PaperChaseWebb
- Works with: Claude Code, Codex (named in the listing); Plain .md
- Price: Free USD
- Difficulty: Intermediate
- Setup time: 30 min
- Time to result: One working session
- Format: Markdown (.md) file, replicate-a-scary-agent-security-claim-with-a-harmless-canary-before-you-react.md
- Version: 1.0, updated 2026-10-29
- License: Personal and commercial use. Credit the original source when you share the workflow.

## What you end up with

The result is not that the attack is fake; it is that it did not reproduce on those versions and settings, and the original may have used other versions, folders or prompts.

## What you get

- A plain-language summary of the workflow
- A fill-in prompt template
- What to watch out for
- A link to the original source

## Who it is for

Builders who already use AI agents and want a proven workflow they can copy into their own project.

## Tools needed

- Codex 0.160.1: one of the two agents under test
- Claude Code 2.1.296: the other agent under test
- Docker: throwaway containers so nothing real is exposed
- Canary file: a harmless marker the planted instructions ask the agent to create
- You need: An AI coding agent or chat model
- You need: A small real task to try it on

Cost to run: Free with the agent plan you already use.

## How it works

1. **Write down the exact claim: which agent, version, setting and success .** Write down the exact claim: which agent, version, setting and success rate. Expected: Done before you move to the next step.
2. **Replace any harmful payload with a canary, such as creating an empty m.** Replace any harmful payload with a canary, such as creating an empty marker file. Expected: Done before you move to the next step.
3. **Build a matrix of agents and modes and run each cell at least 20 times.** Build a matrix of agents and modes and run each cell at least 20 times in fresh throwaway containers. Expected: Done before you move to the next step.
4. **Count canary hits per cell and record versions and settings.** Count canary hits per cell and record versions and settings. Expected: Done before you move to the next step.
5. **Report the result with its limits, including what you did not test.** Report the result with its limits, including what you did not test. Expected: Done before you move to the next step.

## Sample prompt: Workflow template (Codex 0.160.1, Claude Code 2.1.296)

```
Apply this workflow to [your project]:
1. Write down the exact claim: which agent, version, setting and success rate.
2. Replace any harmful payload with a canary, such as creating an empty marker file.
3. Build a matrix of agents and modes and run each cell at least 20 times in fresh throwaway containers.
4. Count canary hits per cell and record versions and settings.
5. Report the result with its limits, including what you did not test.
Stop and ask me before anything irreversible: deploys, payments, sends or deletes.
```

Adapted by PaperChaseWebb. Not the original author's prompt.

## Free preview of replicate-a-scary-agent-security-claim-with-a-harmless-canary-before-you-react.md

````markdown
# Replicate a scary agent security claim with a harmless canary before you react

PaperChase agent use case (free feed entry), version 1.0. Source: [Chris Johnson (@ComputeGhost)](https://x.com/ComputeGhost/status/2115299194454028514), 2026-10-28.

## What they did

The original post claimed high hijack rates when an agent is launched in a folder that contains a planted instruction file. He replaced the payload with a canary (an instruction to write a marker file that does nothing), ran each agent in its default mode and in its sandboxed mode, 20 runs per cell, in fresh containers, and counted how often the canary appeared. It never did on the versions he tested.

## Worth knowing

The result is not that the attack is fake; it is that it did not reproduce on those versions and settings, and the original may have used other versions, folders or prompts. The method is the takeaway: a canary instead of a real payload, a matrix of agents and modes, enough runs per cell, fresh containers, and a report that names versions. It is a good habit before you change your setup because of one alarming post.
````

## Worth knowing

- The result is not that the attack is fake; it is that it did not reproduce on those versions and settings, and the original may have used other versions, folders or prompts. The method is the takeaway: a canary instead of a real payload, a matrix of agents and modes, enough runs per cell, fresh containers, and a report that names versions. It is a good habit before you change your setup because of one alarming post.
- Figures are as reported by the original author and were not re-measured by us.

## Questions

**Where does this come from?** A public post credited to Chris Johnson (@ComputeGhost). Source: https://x.com/ComputeGhost/status/2115299194454028514

**Is it free?** Yes. Feed entries are free to read and download.

## How to get it

Free sample. Download it directly at https://paperchasewebb.ai/bots/marketplace/items/replicate-a-scary-agent-security-claim-with-a-harmless-canary-before-you-react/, no signup.

Seller: PaperChaseWebb Inc., mgmt@paperchasewebb.com