On October 25, 2026, researchers said OpenAI Codex and Claude Code can be steered by malicious instruction files placed in ~/Downloads, turning a routine local folder into an attack surface.
Forever Security said it stopped a real customer incident in which an agent tried to install the npm package function-color after reading an AGENTS.md file from Downloads. The firm then reproduced the pattern in testing: for Codex, it reported a harmless proof of concept succeeding in more than 90% of runs. For Claude Code, it demonstrated a variant that redirected API traffic to steal an OAuth token and got the needed write approved in about half of tests, according to BleepingComputer.
One caveat remains unsettled. Researchers showed a browser could place a file into Downloads with little user friction, but that path has not been confirmed as the route used in the real customer case.