A Webpage Can Silently Drop a 13KB File That Hijacks Your Coding Agent: Codex Obeyed It More Than 90 Percent of the Time

Security researchers at Forever Security, Gal Weizman and Omer Samet, disclosed on October 22 what may be the simplest working exploit against AI coding agents: a plain text file that lands in your Downloads folder. In the firm's lab reproduction, Codex followed the planted instructions in more than 90 percent of attempts, and a Claude Code variant succeeded in roughly half of them. The attack requires no vulnerability in either product. Reading the file is the feature.

The mechanism exploits two converging habits. First, a webpage can save a file into the Downloads folder without a single click, choosing both the name and the contents; a Markdown file is not an executable, so two decades of download protections do not apply to it. Second, coding agents automatically load AGENTS.md, CLAUDE.md and similar instruction files as trusted project guidance before the user's first prompt. An agent launched in a contaminated folder cannot tell your engineering conventions from an attacker's script.

The sample Forever found on a real customer machine was a 13-kilobyte document that read like a thorough team environment setup guide, more professional than most READMEs. Its final lines, though, asked the agent to register an attacker-controlled tool server in ~/.codex/config.toml — the machine-wide configuration — and to install an npm package called function-color, which CloudSEK and Checkmarx attribute to the MALFEX malware campaign that had lurked on npm for roughly two years. Because the registration is global, deleting the downloaded folder does nothing: the malicious server wakes up in every future session, on any project, until the config is manually cleaned.

The Claude Code variant was more surgical. Instead of installing packages, it talked the agent into rewriting its API base URL to a proxy the researchers controlled, which exposed the agent's login token. Forever's telemetry adds an uncomfortable denominator: about half of its customers run a coding agent inside their Downloads folder, usually to tidy it up.

Days later, JFrog Security Research documented the same idea weaponized in the wild. On October 26 it described the testmetest npm worm, which hijacked 42 real repositories across 11 owners by pushing a payload at .github/init.js sized between 12.9 and 13.7 megabytes — deliberately above the roughly 350-kilobyte ceiling of GitHub code search, so the hooks were invisible to routine sweeps — plus trigger files for four tools: a SessionStart hook in .claude/settings.json for Claude Code, equivalents for Gemini and Cursor, and a .vscode/tasks.json folder-open task. The commits were forged to copy the message and author date of real ones, with skip-checks flags appended.

There is no patch on the horizon, because vendors would have to stop agents from reading instruction files, which would break the product. The defenses that remain are behavioral: never launch an agent in a Downloads or Desktop folder, read the instruction and settings files in any repository you did not write before starting a session, and rotate credentials after testing unfamiliar code. Preflight scanners that inventory what an agent will auto-load are beginning to appear as a stopgap.

The deeper problem is that the boundary between documentation and executable configuration has collapsed. A file any website can write to disk is now treated as instructions by software with your credentials and your permissions. Until permission models catch up, the Downloads folder is the new email attachment — and this time the exploit opens itself.