Software Engineer • AI & Systems 👨💻 Talking tech & corporate life x sarcasm Travelling & exploring on two wheels 🏍️ Anime ⛩️ × Photography 📸 × Travel ✈️
Bangalore, India
Joined October 2026
- Tweets1.4K
- Following737
- Followers1K
- Likes2.1K
Pinned Tweet
A plain text file sitting in your Downloads folder can now silently hijack Claude Code and OpenAI Codex to take over your machine.
And the scariest part? OpenAI and Anthropic can't even patch it because the AI is doing exactly what it was designed to do.
Here is how the AGENTS.md attack disclosed this week works👇:
1. Every modern browser allows websites to silently drop a file into your ~/Downloads folder via drive by download without asking where to save it.
2. Attackers are dropping silent AGENTS.md and CLAUDE.md markdown files directly into developers' Downloads directories.
3. The moment a developer spins up Claude Code or Codex inside ~/Downloads to test a quick file or zip archive, the agent automatically ingests that markdown file as "trusted project instructions."
4. In live tests, the hidden markdown instructions forced Codex into arbitrary remote code execution 90% of the time installing rogue npm packages, altering .codex/config.toml MCP servers, and rerouting ANTHROPIC_BASE_URL to steal OAuth tokens.
There is no CVE and no memory bug to fix. If you ever launch a coding agent inside ~/Downloads, you just gave every website you visited full terminal access to your laptop.
The Quiet Engineer retweeted
there's a reason they call it God's Own Country, easily one of the most beautiful places in South India ♥️
there's a reason they call it God's Own Country, easily one of the most beautiful places in South India ♥️
The Quiet Engineer retweeted
bro saw what happened to the "Day in the Life" influencers and pulled the ultimate Uno Reverse...
0% lifestyle, 100% staring at a screen we need to appreciate the people finally showing what an actual software engineering job looks like
There are two completely different species working in tech:
1. The backend engineer losing his hairline debugging a broken production deployment at 9 PM.
2. The 'day in the life at Google' influencer whose entire sprint consists of eating 4 free meals, grabbing free merch, answering 2 emails, and filming an aesthetic reel in the office mirror.
Somehow they both had to pass 5 rounds of LeetCode Hard to get there.
The Quiet Engineer retweeted
next week: "People owning their own lungs is actually terrible from a global oxygen allocation perspective. Everyone should just rent air from our data center for $20/month"
bro saw what happened to the "Day in the Life" influencers and pulled the ultimate Uno Reverse...
0% lifestyle, 100% staring at a screen we need to appreciate the people finally showing what an actual software engineering job looks like
There are two completely different species working in tech:
1. The backend engineer losing his hairline debugging a broken production deployment at 9 PM.
2. The 'day in the life at Google' influencer whose entire sprint consists of eating 4 free meals, grabbing free merch, answering 2 emails, and filming an aesthetic reel in the office mirror.
Somehow they both had to pass 5 rounds of LeetCode Hard to get there.
Good morning X 🌞
stop scrolling the moment you wake up.
your brain just woke up and you're already feeding it hundreds of random things to process.
then you wonder why you feel mentally exhausted before the day has even started
btw I think this cat is in bad mood today :/
The Quiet Engineer retweeted
bro looked at people buying RAM once and using it for years without paying a monthly subscription and took it personally
bro looked at people buying RAM once and using it for years without paying a monthly subscription and took it personally
The Quiet Engineer retweeted
A plain text file sitting in your Downloads folder can now silently hijack Claude Code and OpenAI Codex to take over your machine.
And the scariest part? OpenAI and Anthropic can't even patch it because the AI is doing exactly what it was designed to do.
Here is how the AGENTS.md attack disclosed this week works👇:
1. Every modern browser allows websites to silently drop a file into your ~/Downloads folder via drive by download without asking where to save it.
2. Attackers are dropping silent AGENTS.md and CLAUDE.md markdown files directly into developers' Downloads directories.
3. The moment a developer spins up Claude Code or Codex inside ~/Downloads to test a quick file or zip archive, the agent automatically ingests that markdown file as "trusted project instructions."
4. In live tests, the hidden markdown instructions forced Codex into arbitrary remote code execution 90% of the time installing rogue npm packages, altering .codex/config.toml MCP servers, and rerouting ANTHROPIC_BASE_URL to steal OAuth tokens.
There is no CVE and no memory bug to fix. If you ever launch a coding agent inside ~/Downloads, you just gave every website you visited full terminal access to your laptop.
$6.3 BILLION gone from a single DevOps engineer's fxcking laptop
this dude just speedran the most expensive production incident in human history...
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.
As an immediate precaution, Binance has:
- temporarily suspended deposits and withdrawals while security checks are completed;
- revoked the affected address authorisation;
- engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
binance.com/en/support/annou…
There are two completely different species working in tech:
1. The backend engineer losing his hairline debugging a broken production deployment at 9 PM.
2. The 'day in the life at Google' influencer whose entire sprint consists of eating 4 free meals, grabbing free merch, answering 2 emails, and filming an aesthetic reel in the office mirror.
Somehow they both had to pass 5 rounds of LeetCode Hard to get there.
And while we're talking about what real engineers actually deal with at work...
Binance was just hit with the largest cyberattack in crypto history ($5.5B+ impacted) using an insane 50 nonce Ethereum exploit. Just broke down the exact technical loophole they used here 👇
teapaw.org/tquietengineer/status/…
🚨 BREAKING: Binance was just hit with the largest crypto heist in human history $5.5 BILLION drained in minutes, and the technical trick they used to pull it off is insane.
Withdrawals are halted, Bitcoin is tanking, and over $600M in long positions just got liquidated in a single hour.
How did they bypass the world's biggest exchange? They didn't brute force a password. They exploited a live Ethereum EIP-7702 loophole:
1. EIP-7702 allows a standard wallet to hand over full execution control to a smart contract.
2. Because Binance's main hot wallet (Binance 14) fires thousands of transactions a minute, the attacker couldn't guess the exact live sequence number (nonce).
3. So they sprayed 50 signed authorizations in a single transaction batch. Only ONE of the 50 nonces needed to match the live wallet window and it hit.
4. Within minutes, 167,464 ETH and $1.6B + in USDT vanished before Tether ($1.56B) and Circle ($800M) hit their emergency switches to freeze ~$2.6B of the stolen loot.
One matched transaction number just broke the entire crypto market in broad daylight.
The Quiet Engineer retweeted
🚨 BREAKING: Binance was just hit with the largest crypto heist in human history $5.5 BILLION drained in minutes, and the technical trick they used to pull it off is insane.
Withdrawals are halted, Bitcoin is tanking, and over $600M in long positions just got liquidated in a single hour.
How did they bypass the world's biggest exchange? They didn't brute force a password. They exploited a live Ethereum EIP-7702 loophole:
1. EIP-7702 allows a standard wallet to hand over full execution control to a smart contract.
2. Because Binance's main hot wallet (Binance 14) fires thousands of transactions a minute, the attacker couldn't guess the exact live sequence number (nonce).
3. So they sprayed 50 signed authorizations in a single transaction batch. Only ONE of the 50 nonces needed to match the live wallet window and it hit.
4. Within minutes, 167,464 ETH and $1.6B + in USDT vanished before Tether ($1.56B) and Circle ($800M) hit their emergency switches to freeze ~$2.6B of the stolen loot.
One matched transaction number just broke the entire crypto market in broad daylight.
🚨 BREAKING: Binance was just hit with the largest crypto heist in human history $5.5 BILLION drained in minutes, and the technical trick they used to pull it off is insane.
Withdrawals are halted, Bitcoin is tanking, and over $600M in long positions just got liquidated in a single hour.
How did they bypass the world's biggest exchange? They didn't brute force a password. They exploited a live Ethereum EIP-7702 loophole:
1. EIP-7702 allows a standard wallet to hand over full execution control to a smart contract.
2. Because Binance's main hot wallet (Binance 14) fires thousands of transactions a minute, the attacker couldn't guess the exact live sequence number (nonce).
3. So they sprayed 50 signed authorizations in a single transaction batch. Only ONE of the 50 nonces needed to match the live wallet window and it hit.
4. Within minutes, 167,464 ETH and $1.6B + in USDT vanished before Tether ($1.56B) and Circle ($800M) hit their emergency switches to freeze ~$2.6B of the stolen loot.
One matched transaction number just broke the entire crypto market in broad daylight.
The Quiet Engineer retweeted
meanwhile actual devs are staring at 3 merge conflicts and a 10 PM sync call right now
follow along for unfiltered AI & tech takes minus the aesthetic mirror reels 🤝