Hackers Can Hijack OpenAI Codex and Claude Code Using Malicious Files in Downloads Folder

A plain text file placed in the Downloads folder can trick AI coding agents into changing their settings, installing malware, or exposing login tokens. Forever Security discovered the risk after stopping an agent on a real customer’s computer from installing a known malicious npm package. The company later reproduced separate attack paths against OpenAI Codex and Anthropic Claude Code in controlled tests. The incident began when Forever Security blocked an AI coding agent from installing a package named function-color. Investigators traced the order back to an AGENTS.md file stored in the customer’s ~/Downloads folder. The file looked like a normal set of engineering notes, but it contained carefully written instructions telling the agent to change its own setup and install the package. The source of the file remains unknown.

Also reported by Martin Cid Magazine, CyberSecurityNews.

First reported by Cyber Security News. This page is a short excerpt; the full text is theirs.