Malicious file triggers code execution

A text file placed in a client's Downloads folder prompted their coding agent to install a malicious npm package, according to researchers from Forever Security. The company reproduced the attack on Codex and Claude Code without any flaws to fix. The attack involved an AGENTS.md file placed in the ~/Downloads folder, which also served as the agent's working directory. No one had placed this file, and no one knew how it had gotten there.

AGENTS.md file contains project instructions

The AGENTS.md file contains the instructions that a coding agent follows on a project, from tools to use to how to run tests. Codex reads it at startup and executes what it finds. Researchers noted that the Downloads folder has something particular: it is the only one in which the web can write by itself. Chrome, Edge, and Firefox record their downloads in this location without asking where to place each file, and a page can deposit an AGENTS.md without the user's knowledge.

Webpage deposits files without user action

Forever Security's analysis showed that a webpage can deposit a file in the Downloads folder without a click. A verified demonstration by Bleeping Computer did successfully retrieve a file with harmless content. Markdown, on the other hand, never executes, so no safety measures apply. However, in the hands of an agent, these instructions are still executed.

Risk increases with agent browsing habits

The risk increases with another habit, that of allowing agents to browse. According to Forever Security's measurements, a quarter of sessions open a real browser, and half of the clients launch an agent in their Downloads folder at least sometimes. For them, Claude Code has started more than 1,300 times from this location. The agent sometimes searches for the file that returns it on its own, and no one notices.

Attack demonstrates code execution on Codex

A package installed on Codex and a token stolen on Claude Code. The researchers replayed the client's file exactly as is, in an isolated virtual machine. You open Codex in the folder, you ask it anything, and before starting your task, it adds a "project tools" server to its configuration and installs the package from npm. "Codex just executed the attacker's code in a single session," summarize Gal Weizman and Omer Samet, who note a success rate of over 90%.

Attack adapts to Claude Code's defenses

The file, a 13 KB document resembling an engineering guide, is written in ~/.codex/config.toml, the configuration of the entire machine. Each subsequent session then loads the pirate's server in any folder. Claude Code proved more resilient, and the attack had to change its target. A CLAUDE.md file pushes the agent to redirect its API traffic to a server controlled by the researchers, via the ANTHROPIC_BASE_URL variable slipped into a settings file. Each request then carries Claude's OAuth token, allowing it to impersonate the victim before the real API. The pirate server then responds on behalf of the model and returns commands that the client executes. Claude Code completed the chain in about half of the attempts.

Publishers deny responsibility for the risk

On the side of OpenAI and Anthropic, there is nothing to fix. "An agent that follows the AGENTS.md file in its folder does exactly what it was designed for," recall the researchers. The two publishers advise launching the agent from the folder of the concerned project, never from Downloads, and to keep validations and sandboxing active. For small businesses and micro-enterprises, a developer who launches an agent without this framework opens a new entry point for hackers.

Attack relies on agent interpreting text as commands

An AGENTS.md or CLAUDE.md file often serves as a "project memo" that some coding agents treat as a source of operational instructions (tools to activate, commands to run, work rules). Markdown does not execute anything by itself, but the agent can interpret its content as directives, then launch actions via the shell, a package manager (npm), or internal "tools." The risk therefore comes from the chain "text → interpretation by the agent → execution by the environment," without the operating system seeing a suspicious binary to block.

Downloads folder acts as a web-accessible drop zone

It is a form of context injection: the file is harmless to a human, but becomes active through the agent's logic. The more permissions the agent has (network, configuration writing, command execution), the higher the potential impact. How can a webpage deposit a file in the Downloads folder without explicit action, and why is this an attack vector? Browsers allow file downloads to the default location (often Downloads) without asking for a destination folder each time, especially if the "always ask where to save" option is disabled. A page can therefore trigger one or more downloads and make a file appear in this folder, even if the user does not expect to find "configuration" files there. This does not launch an executable, but it is enough to place a document that the agent will automatically read if it uses Downloads as its working directory.

Redirecting API traffic can steal tokens

The Downloads folder then becomes an indirect "drop zone" accessible from the web, which is problematic if local tools search for directive files there. The attack relies less on a browser flaw than on the dangerous assumption that a folder fed by the Internet can serve as a trust base for an agent. What does redirecting an AI client via a variable like ANTHROPIC_BASE_URL mean, and how can it lead to the theft of an OAuth token? A variable of the type ANTHROPIC_BASE_URL serves to change the URL of the API server contacted by the client, which in practice allows it to communicate with a proxy or a fake endpoint controlled by a third party. If the client sends its OAuth token in the headers (for example, "Authorization"), this token can be retrieved by the intermediate server, then reused to impersonate the user before the legitimate service. Beyond the theft of credentials, the proxy can also return "false but plausible" API responses and influence the client's local actions (commands, file modifications) if it executes instructions from the responses. It is a variant of an endpoint hijacking attack, targeting the configuration layer rather than a cryptographic vulnerability. Effective protections are strict validation of authorized endpoints, isolation of secrets, and explicit confirmations before any impactful action.