A web page can drop AGENTS.md into Downloads, and Codex obeys it

Forever Security demonstrated that a page can save an AGENTS.md file to ~/Downloads without a click, and a coding agent reads it as instructions. Codex ran a malicious npm package in over 90% of attempts; a CLAUDE.md variant succeeded about half the time.

• Chrome, Edge and Firefox save to ~/Downloads without prompting; Brave is the exception
• Codex ran the payload in 90%+ of attempts, writing an MCP server into ~/.codex/config.toml
• Redirecting ANTHROPIC_BASE_URL sends Claude's OAuth token to an attacker server
• About a quarter of agent sessions open a browser; half of customers run agents from Downloads