Planted AGENTS.md hijacks Codex and Claude Code — nothing to patch
A web page can drop the file into Downloads with no click. Codex ran the payload 90%+ of the time; Claude leaked its session token about half.
Copy markdown
One instructions file, two hijacked agents
Forever Security caught a booby-trapped AGENTS.md on a real customer's machine and stopped the agent before any code ran. Coding agents read the instructions file in whatever folder they open and follow it as direction, so a planted doc is a command channel. The firm's verdict: there's nothing for OpenAI or Anthropic to patch — the agents did exactly what they were told.
Codex ran the malware 90%+ of the time
Disguised as routine project setup, the file told Codex to register a server in ~/.codex/config.toml and install the npm package function-color, which pulls in function-flag — a downloader for the MALFEX Windows payload. That config applies to every Codex session on the machine afterward, not just the one folder.
The Claude Code variant leaks your token
A planted CLAUDE.md, framed as internal gateway setup, got Claude to write an ANTHROPIC_BASE_URL into project settings — routing your API traffic and session login token to the attacker's server, which then feeds back commands to run. Claude usually refuses odd writes, but the long engineering-doc framing got it approved about half the time.
How the file lands: a silent download
A web page can save a named file to your Downloads with no click or prompt; Forever built a proof-of-concept that drops an AGENTS.md this way. Their telemetry: about half of customers run an agent in Downloads, and roughly a quarter of agent sessions open a browser — exactly the conditions the attack needs.
What to check tonight
Don't start agents in ~/Downloads. Read any AGENTS.md or CLAUDE.md you didn't write, including in freshly cloned repos. Audit ~/.codex/config.toml for unknown server blocks and .claude/settings.json for a stray ANTHROPIC_BASE_URL. If you find one, assume your token leaked and rotate it.