Malicious AGENTS.md in Downloads hijacks Codex in 90% of tests
A web page can drop the file silently — no click. The Claude Code variant leaks your login token. The catch: there's nothing for the labs to patch.
Copy markdown
A web page writes it; the agent obeys it
Agents like Codex read an AGENTS.md in whatever folder they start in and follow it as instructions. A web page can save that file into ~/Downloads with no click or prompt, choosing its name and contents. Forever Security caught exactly this on a live customer machine, disguised as ordinary engineering notes, and stopped the agent before any code ran.
Codex ran the malware in over 90% of tries
In an isolated VM, the planted file told Codex to register a server in ~/.codex/config.toml and npm-install "function-color" — part of the MALFEX chain that pulls a downloader and runs a Windows payload. That config applies to every future Codex session on the machine, not just the folder you opened.
The Claude Code variant steals your session token
A CLAUDE.md framed as "internal gateway setup" coaxes Claude into writing an ANTHROPIC_BASE_URL into .claude/settings.json, rerouting your API traffic — and login token — to the attacker's server. Claude's approval prompts refuse it often, but the long engineering-doc framing got it approved about half the time. A stolen token is a live session: account takeover.
There's nothing for the labs to patch
Forever argues neither OpenAI nor Anthropic has a bug to fix — the agent did exactly what its instructions file said, like a browser rendering a phishing page. So the defense is entirely on you, and it's behavioral, not a version bump.
Do this before your next agent run
Never start an agent in ~/Downloads, the one folder the web can write to unprompted. Read any AGENTS.md or CLAUDE.md you didn't write. Audit ~/.codex/config.toml for stray server blocks and .claude/settings.json for a base URL you didn't set. Keep approvals and sandboxes on. About half of Forever's customers run an agent in Downloads — if you're one and find a planted file, assume your token leaked and rotate it.