AGENTS.md in Downloads folder can hijack AI coding agents

Forever Security showed that a plain-text AGENTS.md file in ~/Downloads makes OpenAI Codex and Claude Code install the malicious npm package function-color. The Codex attack succeeded in over 90% of tests and the Claude Code one in about 50%, with no bug in the agents themselves.

• Browsers write files to Downloads without approval, and agents read instructions there
• Codex rewrites ~/.codex/config.toml, so the compromise persists across folders
• Claude Code via CLAUDE.md redirects API traffic and leaks OAuth tokens
• About half of Forever Security's customers ran agents inside Downloads