Claude Code and Codex will obey any file a website places in the Downloads folder
Claude Code and Codex obey a file any website can drop in your Downloads
Forever Security researchers found a planted AGENTS.md file on a customer's machine that instructs coding agents to install a known piece of malware. AGENTS.md is a plain-text instruction file read at startup by tools such as OpenAI's Codex, and CLAUDE.md is its counterpart in Claude Code. The report notes that when a user opens Claude Code or Codex in the Downloads folder, the agent trusts that folder as if it were its own project, so files a website saves to the Downloads folder can issue instructions to the agent; and under the agent's own rules, its behavior is not a violation.
The original source gives a real case of a coding agent launched in the Downloads folder being hijacked by a malicious instruction file; users who commonly use Claude Code or Codex can check their usage habits against it.