A plain text file in your Downloads folder can hijack a coding agent

What the researchers say happened

As qbitai.com reported, the security firm Forever Security described an attack in which simply visiting a web page leaves a text file named AGENTS.md in your Downloads folder. Nothing is clicked and nothing is run.

The trap springs later. If you open a terminal in that folder and start an AI coding agent such as Codex or Claude Code, the agent picks up the file on its own.

Why an agent obeys a text file

AGENTS.md and CLAUDE.md are files where developers write house rules for an agent, such as which language version to use. Agents read them automatically at startup, which is convenient.

The weakness is that the agent cannot reliably tell a developer's genuine rules from an attacker's. The qbitai article puts it this way: to an agent that can run commands, a Markdown file works like a program.

A disguise built to look boring

The attack was not a crude order like "delete files". It was a long, professional-looking setup guide, and a request to register a tools server in Codex's global config file sat at the very end.

According to the article, Codex then ran a process with its approval and sandbox (a protective box that limits what software can touch) switched off, and it edited its machine-wide settings. That means the compromise would survive closing the window or deleting the file.

For Claude Code, the described trick was changing a setting so its requests went to an attacker's proxy, which could expose a login token. The firm reported that Codex fell for it most of the time and Claude Code about half the time. These are the firm's own results, so treat them as unverified until others reproduce them.

What to do now

• Do not start an agent in Downloads or Desktop; use a clean project folder.
• Read AGENTS.md and CLAUDE.md in any repository you did not write, and watch for hidden characters.
• Check your global Codex config and any custom Claude base URL for entries you did not add.
• Keep folders such as ~/.ssh and ~/.aws out of the agent's reach.

The article also says model makers cannot simply patch this, because reading these files is the intended feature. A clean check does not prove your machine is safe.