Hackers can hijack Codex and Claude Code via malicious files in the Downloads folder
Hackers can hijack Codex and Claude Code via malicious files in the Downloads folder
A plain text file in ~/Downloads can trick AI coding agents into changing settings, installing malware, or leaking authorization tokens, according to Forever Security.
Hackers can take control of OpenAI Codex and Anthropic's Claude Code using malicious files placed in the user's Downloads folder.
A regular text file in ~/Downloads can cause AI agents to change their own configuration, install malware, or reveal user authorization tokens.
The story began when Forever Security's protection system blocked an AI agent's attempt to install the npm package function-color, which was distributing malware.
During the investigation, specialists found that the installation command came from an AGENTS.md file located in ~/Downloads on the client's computer.
«This is not ordinary malware,» wrote researchers Gal Weizman and Omer Samet. «AGENTS.md is a file that an agent is inherently supposed to trust and whose instructions it is expected to follow. And ~/Downloads is the only folder where a website can place a file without a single click and without user permission. Together, these features allow a website to silently drop commands that your own agent then executes. Markdown is becoming new executable code.»
The researchers reproduced the attack against OpenAI Codex and Anthropic's Claude Code:
- Codex followed malicious instructions in more than 90% of tests.
- Claude Code was susceptible in about 50% of cases.
According to the researchers, «there is nothing for OpenAI and Anthropic to fix here.» An agent executing instructions from a file in its working directory behaves exactly as designed, similar to a browser displaying a phishing page technically performing its function.
They recommend not running development AI agents from the Downloads folder and carefully reviewing any AGENTS.md or CLAUDE.md files the user did not create before granting the agent access to that directory.
This also applies to repositories a developer has just copied to their computer.
If you ever ran Codex or Claude Code from the Downloads folder, you should check your configuration files for unknown servers and links.
Why it matters
AnalysisAI coding agents often treat local Markdown instruction files as trusted context, so silent file drops in Downloads can turn ordinary text into a remote command channel for malicious code execution and token theft.
Discuss in community
Share your questions and insights with developers
Related in Ecosystem
Practical guides, core terminology, and agent skills
One line in AGENTS.md made Claude Code and Codex follow code over outdated documentation
Researchers showed that coding agents often follow outdated documentation even when they detect contradictions with real code. A single instruction in AGENTS.md increased adherence to existing code from 4% to 91%.
Claude Code Projects: How a Single AI Orchestrates a Team of Autonomous Agents
A deep dive into Claude Code Projects: Coordinator and Threads architecture, parallel branches, shared memory via MEMORY.md, and cloud agent management.
Part II. How to Work with Codex + Optimization/Security/Team
Codex is not just code autocomplete in a chat; it is a full-fledged engineering agent: it reads the repository, plans changes, edits files, runs tests, reviews its own diffs, and c...
Claude Code
The official terminal agent from Anthropic, operating directly in the command line via Claude 3.7 Sonnet with native support for Bash, Git, file systems, and the MCP protocol.
Hallucinated Dependencies in Code
A dangerous variant of neural network hallucinations in programming. The model fabricates plausible yet non-existent libraries and npm/PyPI packages, creating critical security vulnerabilities (Slopsquatting).
Bob Martin Publishes Rules for AI Agents Writing Code
Bob Martin, author of Clean Code, published the ub-mode GitHub repository with rules that guide his own AI coding agents.