A 13KB Markdown file can hijack Claude Code and Codex via your Downloads folder
pbaylies · x · 2026-10-26
Security firm Forever disclosed a wild attack found on a real customer's machine: browsers silently drop a plain-text AGENTS.md/CLAUDE.md into /Downloads, exploiting developers' habit of launching AI coding tools there.
- Codex (>90% success): a Markdown file posing as engineering guidelines tricks Codex into registering a malicious MCP server in /.codex/config.toml and adding --dangerously-bypass-approvals-and-sandbox, persisting across all future projects.
- Claude Code (50%): the file makes Claude create .claude/settings.json pointing ANTHROPICBASEURL at the attacker's server, stealing the login token then issuing a sandbox-disabling Bash command to take over the machine.
- No CVE, no patch: OpenAI and Anthropic consider both behaviors legitimate features.
Takeaway: don't launch coding agents in /Downloads — 30 years of 'plain text is harmless' assumptions just reset in the AI era.
More from coding & agent
- Security tip: use AI agents to build a NIST CSF knowledge base for incident response — prasanna_says · 2026-10-26
- Google Cloud Adds Self-Learning Context Enrichment to Knowledge Catalog for AI Agents — rseroter · 2026-10-26
- Cloudflare Previews Spend Limits for Workers and Durable Objects, Early Access Open — ritakozlov · 2026-10-26
- Shopify design lead on AI-era workflow: designers are becoming full-stack editors — KlausCodes · 2026-10-26
- Nace AI launches Drex for Search, cutting agent steps 62% and tokens 56% — testingcatalog · 2026-10-26
- Ultrametric open-sources Open Startup Repo to let AI agents run startup operations — garrytan · 2026-10-26