Planted AGENTS.md in Downloads can hijack Codex and Claude Code

Forever Security showed that a malicious AGENTS.md or CLAUDE.md dropped into ~/Downloads can make coding agents follow attacker instructions. Codex added a malicious npm package to its global config in over 90% of attempts, while Claude Code leaked a live OAuth token in roughly one run in five.

• Codex added malicious npm package function-color to ~/.codex/config.toml in >90% of tests
• Claude Code executed code and sent a live OAuth token in about 20% of runs
• The stolen token was successfully replayed against the real API
• No patch: agents read instruction files in their working folder by design