Malicious Downloads Can Trick AI Coding Agents Into Compromising Themselves
CSO Online, Monday, October 26th, 2026
Researchers show malicious AGENTS.md and CLAUDE.md files in a downloads folder can steer Codex and Claude Code into compromising themselves.
Forever Security found a malicious AGENTS.md file in a customer's Downloads folder that told OpenAI's Codex to install a malicious npm package, an attempt that was blocked.
In tests Codex followed such instructions over 90 percent of the time and could alter its machine-wide MCP configuration, while a CLAUDE.md file redirected Claude Code API traffic to expose tokens in about half of tests.
The files contain no code but exploit agents treating instructions as privileges.
Analysts call it a credible early warning and advise disabling approval-bypass flags, reviewing instruction files like source code, keeping sandboxes on, restricting network access and routing installs through internal registries.