Tech · 7 d ago
A planted file in the Downloads folder can trick AI coding agents into installing malware
Instructions file
AGENTS.md
Forever Security found a file called AGENTS.md that agents such as OpenAI's Codex are built to trust and follow. A web page can save one to Downloads with no click and no permission prompt.
Tests on Codex
>90 % of attempts ran the malware
In the firm's tests, Codex ran the attacker's malware in more than 90 per cent of attempts.
Anthropic's Claude Code was harder to fool. The researchers' own test file got a settings change approved about half the time, which would send the user's login token to a server the attacker controls.
What to do
Do not start a coding agent in the Downloads folder, and read any AGENTS.md or CLAUDE.md file you did not write before an agent opens it. Anyone who finds a planted file should assume the login token leaked and replace it.
