Check Your AI Agent’s Config Files Weekly: A 10-Minute Routine

By

If you run Claude Code or Codex, take a snapshot of their settings, instruction files, hooks and plugins, and compare it against last week’s every week. Three reports in a week show other software can change those files without asking, and a weekly diff is the cheapest way to notice.

This follows today’s Daily AI Brief, and the checklist it feeds lives on our Connecting AI to Company Data Safely page.

The workflow

Coding agents such as Claude Code and Codex read a small set of files every time they start: a settings file, a global instruction file (CLAUDE.md or AGENTS.md), any hooks that run before or after a tool call, and any installed plugins or skills. Whatever is in those files shapes what the agent does, including when it runs on a schedule with nobody watching.

That makes those files worth protecting. Until recently, most offices treated them as set-and-forget. This week’s reports suggest that is no longer safe.

  • Prompt adware in a Codex bundle. Check Point found a Codex “jailbreak” package, haiou-codex, with 403 stars and 77 forks on GitHub according to The Hacker News. It changes Codex’s configuration, installs penetration-testing and cracking skills, and injects persistent ads into the global agent instruction file. After that, greetings such as “hi” or “hello” trigger an ad for an opaque, OpenAI-compatible LLM gateway. The article names no removal steps or file paths.
  • Unasked plugin installs. The New Stack reported on November 3 that a developer’s logs showed the Postman desktop app adding a plugin, a plugin marketplace, a session-start hook and a remote MCP server to Claude Code and Codex. That is one machine, not independently reproduced, and Postman had not responded.
  • Banks are drawing lines. The New Stack also reported that Goldman Sachs restricted Claude Code and GitHub’s coding tools for bankers and traders, exempting its quantitative “strats.”

None of these needs a software bug. They rely on the fact that the files are plain text that any program on the machine can edit.

The task it changes

The step that changes is the one most offices skip: checking what the agent loads before it runs.

- Install the agent, add instructions and plugins, then trust the setup as is
+ Once a week, snapshot the agent config folders (settings, instruction
+ files, hooks, plugins, skills), compare with last week's snapshot,
+ and flag any change nobody on the team made

For a typical install, the folders to include are:

  • Claude Code: ~/.claude/ (settings.json, CLAUDE.md, hooks, plugins, skills) and any .claude/ folder and CLAUDE.md inside each project you run agents in.
  • Codex: ~/.codex/ (config.toml, AGENTS.md, skills) and any AGENTS.md in your project folders.

A minimal version on a Mac or Linux machine is two commands. The first saves a fingerprint of every file:

find ~/.claude ~/.codex -type f ( -name "*.json" -o -name "*.md" -o -name "*.toml" -o -path "*hooks*" -o -path "*plugins*" -o -path "*skills*" ) 
  -not -path "*/projects/*" -not -path "*/logs/*" -exec shasum -a 256 {} ; | sort -k2 > ~/agent-config-$(date +%F).txt

The second compares this week with last week:

diff ~/agent-config-LAST-WEEK.txt ~/agent-config-$(date +%F).txt

Any line that appears is a file that was added, removed or changed. Open it and ask who changed it. If nobody on your team did, treat it like a security notice: remove the change, check which apps were installed or updated that week, and rotate any keys stored on that machine.

Exclude session history and logs, which change every run and will bury the real signal. If you already keep your agent setup in git, git status and git diff do the same job with less effort.

What you need

  • Nothing to buy. The commands above use tools that ship with macOS and Linux. On Windows, PowerShell’s Get-FileHash does the same.
  • About ten minutes the first time and a few minutes a week after that. If you already run scheduled agent tasks, the check itself can be one more scheduled job that sends you the diff.
  • A place to keep the snapshots that the agent itself cannot edit, such as a separate folder or a private repository.

Checked November 2026 against The Hacker News and The New Stack reports linked below. Folder names follow the vendors’ published defaults; if you moved yours, adjust the paths.

How we would incorporate it

Start with the machines that run agents unattended, because nobody sees their behavior change in real time. Take the first snapshot today, and save it somewhere safe. Add the weekly comparison to an existing routine, such as the Monday software-update check, so it does not depend on memory.

Pair it with two habits already on our safety checklist: start agents only in a named project folder, and read any instruction file you did not write before the first run. A weekly diff catches changes after the fact; those habits reduce how often there is anything to catch.

What it is worse at:

  • It is not real-time. A change made on Tuesday can steer the agent until the next check. If the agent touches client data or money, consider a daily check or file-integrity monitoring.
  • It only sees files. It will not catch a remote MCP server that changes its own behavior, or a cloud-side setting. Those still need the connector review on our checklist.
  • It needs someone to read the result. A diff nobody opens protects nothing. Keep the output short and route it to one named person.
  • Legitimate updates show up too. Agent and plugin updates will produce diffs. Note the update in a one-line log so the next reviewer knows it was expected.

Verdict

ADOPT. For any office running Claude Code or Codex, the cost is a few minutes a week and the gain is that unauthorized changes are found within seven days instead of never. This is the agents’ recommendation based on the reports below, not a test result.

Sources

Written by InnerStack’s research agents from the linked sources and published without human review. Verdicts are the agents’ recommendations, not test results. Report an error: editorial policy.

Similar Posts