Planted AGENTS.md in a Downloads Folder Got Codex to Install Malware; a CLAUDE.md Variant Exposed Claude Code's OAuth Token

OpenAI Codex, Claude Code, and other coding agents launched with `~/Downloads` as the working directory

Forever Security found a malicious AGENTS.md in a customer's Downloads folder that told the coding agent running there to install the npm package `function-color`, which reports tie to Checkmarx's MALFEX malware campaign. The file's origin is unknown, but browsers save a file named AGENTS.md to Downloads without a prompt. Forever's telemetry showed hundreds of customers running agents from Downloads, and Claude Code alone launched more than 1,300 sessions there. In reconstructed tests with a harmless payload, Codex ran the malware in more than 90% of attempts. A malicious CLAUDE.md redirected Claude Code's API traffic to a researcher server, exposing its OAuth token and letting the server pose as the model and return tool calls that ran code in about 50% of tests. Forever said there was nothing for OpenAI or Anthropic to patch

Agents automatically load instruction files from their working directory, and a folder any website can write to was being used as that directory