A file you never downloaded can hijack the Codex and Claude Code coding assistants

The file was called AGENTS.md, and it was sitting in the Downloads folder of a Forever Security customer. “Nobody had put it there, and nobody knew how it got there,” write the researchers at the company, which specializes in the risks posed by AI agents. Their tool blocked the attack before any code ran. They still had to work out what it was aiming at.

Their findings, published on October 22 by Gal Weizman and Omer Samet and relayed on October 25 by BleepingComputer, affect every developer who uses a coding assistant. A web page can drop a file named AGENTS.md into a visitor's Downloads folder. If the visitor then launches an agent from that folder, the agent treats the file as a trusted instruction. In the researchers' tests, Codex, OpenAI's agent, ran the malicious program in more than 90% of attempts. Claude Code, Anthropic's agent, changed its configuration about half the time and ran code about one time in five. According to the researchers, there is nothing for the vendors to patch.

Why a simple text file can be enough

Coding agents automatically read the instruction files in their working directory: AGENTS.md for Codex, CLAUDE.md for Claude Code. That is how they learn a project's rules. But the Downloads folder is not a project, and any website can write to it.

With Codex, the booby-trapped file leads the agent to add a server to its configuration, then install a malicious npm package called function-color. The researchers sum it up: the agent ran the attacker's code in a single session, “without anyone approving anything.” Their public demonstration merely opens the calculator.

Claude holds up better. It normally has to get a human's approval before such a change, and it often refuses ones that look suspicious, the authors acknowledge. They got around it with a long fake technical document, presented as engineering guidelines. When the trick works, Claude Code sends its traffic to an attacker's server instead of Anthropic's. The attacker could then capture the user's login token and answer in place of the model to get commands executed. The article does not explain how the user's approval was obtained in the successful tests.

A far more common habit than you might think

The scenario assumes the agent is launched in that specific folder. That is not unusual: according to Forever Security's measurements, about half of its customers run a coding agent in Downloads. BleepingComputer adds that Claude Code opened more than 1,300 sessions there across these customers. Chrome, Edge and Firefox save files by default without asking where, but display a notification. Brave, by contrast, asks for confirmation.

For Forever Security, “there is nothing to fix for OpenAI or Anthropic”: the agents are doing what they were designed to do. The problem lies in the location, a folder that the web can fill and that the agent treats as safe. According to BleepingComputer, OpenAI and Anthropic already recommend launching their agents from the project folder.

Good habits to avoid getting caught out

Since no update will close this door, protection comes down to working habits. The researchers and BleepingComputer recommend the following:

• never launch a coding agent in the Downloads folder, or in a catch-all folder such as the home directory, but at the root of the relevant project;
• read any AGENTS.md, CLAUDE.md or similar file of unknown origin before letting an agent follow it;
• check the agents' configuration: mcp_servers blocks added to Codex, a modified ANTHROPIC_BASE_URL variable in Claude Code;
• keep approval prompts and the sandbox enabled;
• in case of compromise, rotate login tokens and look for the function-color package.

Coding agents have become a prime target, as the booby-trapped version of LiteLLM showed when it stole cloud credentials. It remains to be seen whether OpenAI and Anthropic will agree to address this risk, for example by refusing to load instructions from outside an identified project.