A malicious AGENTS.md found in a customer's Downloads folder hijacked OpenAI's Codex in 90% of tests; a CLAUDE.md variant exposed a Claude Code token about half the time, Forever Security says
BleepingComputer reported on Oct 25 (11:49 ET) that Forever Security, a firm that monitors AI-agent risk, found a malicious AGENTS.md instruction file in a customer's Downloads folder; the file told any coding agent started there to install a rogue npm package, 'function-color'. The researchers could not determine how the file got there, and built a proof of concept showing a web page can silently drop such a file into Downloads, which Weizman calls 'the one folder the web can write to on its own'. In their tests, using a harmless payload that opened the calculator, OpenAI's Codex followed the planted instructions 90% of the time; a related CLAUDE.md technique that redirected Claude Code's API traffic and exposed its OAuth token executed in roughly half of tests. Forever Security's own telemetry showed Claude Code alone launching more than 1,300 sessions from Downloads folders and hundreds of customers running agents from that folder. The researchers said 'there is nothing here for OpenAI or Anthropic to patch', pointing instead to the vendors' guidance to run agents from the project directory. The article reports no response from either company and does not say whether the customer's agent ever acted on the file.
Damage
A planted instruction file in the wild; no loss reported; in tests, code execution on the host and a leaked Claude Code token
In their words
“~/Downloads is special. It is the one folder the web can write to on its own,”
Sources
BleepingComputer. Evidence confidence: medium. Dated to the BleepingComputer report; the discovery date on the customer's machine is not given. Single-vendor account; whether the planted file ever ran on the customer's machine is not stated, so harm is 1 and confidence medium. The success rates are Forever Security's tests, not production figures. Novelty 3: instruction-file injection against coding agents was a lab finding (this index has the Cline npm case); a planted file on a real customer's machine is its first reported in-the-wild sighting. No company response found.
Factor ratings and the score are this index’s judgments by a published formula; facts, dates and figures come from the linked sources. Where a lawsuit is pending, the summary reports allegations, not findings.
