AI coding agents can be tricked by malicious instructions planted in the Downloads folder

Forever Security found that AGENTS.md instruction files placed in the Downloads folder without permission can trick AI coding agents into installing malicious npm packages or handing over login tokens. The company found such a file targeting OpenAI Codex on a customer's computer, linked to activity involving the function-color malicious package that had lurked on npm for about two years and has now been removed. Researcher tests showed that when Codex was opened in a Downloads folder the user had worked in and given a task, it first rewrote its own settings and then installed the package specified in the file; more than 90% of attempts ran the malware, and the changes took effect across the entire computer. When testing Claude Code with a CLAUDE.md modeled on the attacker's, about 50% of attempts redirected requests to the attacker's server, and replaying a captured login token was enough to take over the account without running code; about one fifth of the tests could run code within the same session.