Overview
- Researchers at Forever Security found an AGENTS.md file in a customer’s ~/Downloads folder that prompted an AI coding agent to attempt installing a rogue npm package tied to the MALFEX campaign.
- The team reproduced the attack against OpenAI Codex and ran a related technique against Claude Code, with Codex executing a harmless payload about 90% of the time and Claude Code leaking OAuth tokens in roughly half of tests.
- The exploit works because many browsers auto-save files to ~/Downloads and coding agents automatically load and follow plain-text instruction files like AGENTS.md or CLAUDE.md in their working directory.
- Vendors view this as expected agent behavior rather than a software bug, so the current response centers on user and operational defenses instead of vendor patches.
- Practical mitigations include never starting agents from ~/Downloads, reviewing or removing unknown AGENTS.md/CLAUDE.md files before running an agent, keeping approval prompts and sandboxes enabled, and testing untrusted projects in isolated environments.