An AGENTS.md file in Downloads can hijack Codex and Claude Code

A file called AGENTS.md, left in a customer's Downloads folder, told the AI coding agent running there to install a malicious npm package, security firm Forever Security reported on 22 October. In the firm's own tests, the same trick made OpenAI's Codex run the attacker's command in more than 90% of attempts.

Coding agents such as Codex and Claude Code read instruction files from the folder they are started in and treat them as rules for the job. Browsers save downloads to that same Downloads folder by default, and running agents from there is common. According to Forever, about half of its customers start a coding agent in Downloads, and Claude Code alone launched more than 1,300 sessions from that location on their machines.

How the planted AGENTS.md hijacked the agent

The file weighed 13 KB and looked like ordinary engineering guidelines. Near the end it presented an install step as setting up tools before the user's task, which meant installing a package called function-color. Forever's monitoring blocked the install before the code ran, and the package has since been removed from npm. The researchers could not tell how the file reached the machine. They showed that a web page can save a file named AGENTS.md into Downloads without asking: Chrome, Edge and Firefox put downloads there by default and only show a notification, while Brave asked for approval in their tests.

Gal Weizman and Omer Samet then reproduced the attack in a virtual machine. For Codex, the file told the agent to add an MCP server entry to ~/.codex/config.toml, the global config that applies to every Codex session on the computer, so the attacker's command would start each time. With a harmless payload that opened the calculator, it worked in more than 90% of attempts.

For Claude Code they wrote a CLAUDE.md that asked the agent to point the project settings at a supposed internal gateway. Once Claude made the change, its API requests went to the researchers' server together with the user's OAuth token. That server could then answer in place of the model and send the agent commands to run, which led to code execution in about half of the tests. Through a subagent, they got execution inside the same session about a fifth of the time.

Nothing for the vendors to patch

"There is nothing here for OpenAI or Anthropic to patch," the researchers wrote. An agent that follows the AGENTS.md in its folder is doing what it was built to do, so the risk sits in where the agent is started. OpenAI and Anthropic advise running agents from the project directory, and neither company commented on the research. In August a different weakness in Claude Code let a GitHub issue reach CI secrets, and both cases rest on the same problem: the agent can't tell the user's instructions from text it merely reads.

What to check in Codex and Claude Code

• Working folder: start agents in the root of a specific project, not in Downloads or your home folder.
• Instruction files: read any AGENTS.md or CLAUDE.md you did not write before an agent uses it.
• Codex: look in ~/.codex/config.toml for unfamiliar [mcp_servers.*] blocks or a changed chatgpt_base_url.
• Claude Code: check the project's .claude/settings.json for an unexpected API address such as ANTHROPIC_BASE_URL.
• Approvals: keep confirmation prompts and the sandbox on, and be wary of any file that asks the agent to switch them off.

If an agent may already have followed such a file, deleting it is not enough: settings the agent changed stay in place. Remove them by hand and replace your tokens, because a leaked token works as a live login. Forever says that seeing function-color among installed packages means the machine should be treated as compromised.