A Downloaded File Can Hijack Codex and Claude Code

Forever Security, a company that monitors AI agents, says it found a malicious AGENTS.md file in the Downloads folder of a customer's computer, "plain text, disguised as ordinary engineering notes." A coding agent started in that folder read it and tried to install a malicious npm package. Forever says the same trick works on OpenAI's Codex and, in a different form that reroutes traffic to leak the login token, on Anthropic's Claude Code. By its own tests, Forever says "Codex ran the malware in more than 90% of attempts" (mostly with a harmless calculator stand-in) and "Claude followed through on this about 50% of the time."