Forever Security Discloses That Websites Can Silently Drop Malicious AGENTS.md Files Into Downloads Folders to Hijack Codex and Claude Code
千万别在你的 ~/Downloads（下载）文件夹里启动 Claude Code 或 Codex。 昨天安全机构 Forever 披露了一起在真实客户电脑上抓到的野生攻击，看完只能感叹：过去 30 年的系统安全常识，在 AI 时代归零了。 过去 30 年，Chrome 默认允许网页不弹窗就往你的 ~/Downloads 塞一个纯文本文件（比如 .md）。因为系统认为：纯文本又不是 .exe，自己不会跑，怕什么？ 但现在，接近 50% 的开发者干过同一件事——直接在 ~/Downloads 里打开 Claude Code 或 Codex，让 AI 帮自己解压或整理刚下载的文件。 黑客就是卡住这个死角，通过网页静默下载往你的 Downloads 塞一个 13KB 的纯文本 AGENTS.md / CLAUDE.md： 1. 对付 OpenAI Codex（成功率 >90%）： 伪装成「工程规范」的 Markdown 指示 Codex 先往全局配置 ~/.codex/config.toml 注册一个恶意 MCP 服务，并自己加上 --dangerously-bypass-approvals-and-sandbox 跑校验。哪怕你关掉 Downloads，以后在任何正经项目里开 Codex 都会自动加载木马。 2. 对付 Claude Code（成功率 ~50%）： 指示 Claude 建一个 .claude/settings.json，把 ANTHROPIC_BASE_URL 指向黑客服务器。连上的第一秒，你的 Claude 登录 Token 直接明文送给黑客；下一秒，黑客假扮成大模型下发一条关沙盒的 Bash 指令，直接接管电脑。 最黑色幽默的是官方结论： 这个洞没有 CVE，OpenAI 和 Anthropic 也不会发补丁。因为「浏览器自动存文本」是正常功能，「AI 认真读目录下的 Markdown 并严格执行」也是正常功能。 以前黑客想黑你，得苦心积虑写 0day；现在只需要写一篇排版优雅的 Markdown 小作文，你的 AI 就会自己把沙盒关了、把网线接过去、顺手把账号双手奉上。
Context
Because major web browsers automatically save text files to the Downloads folder without prompting and AI coding agents obey instruction files in their working directory by design, visiting a web page can plant persistent malware or steal tokens if a developer launches an agent in Downloads.
AI coding assistants such as OpenAI Codex, Anthropic Claude Code, and Cursor CLI automatically read markdown instruction files like AGENTS.md and CLAUDE.md in their current working directory to learn project conventions and tool settings. Meanwhile, desktop browsers including Chrome, Edge, and Firefox save web downloads directly into a user's Downloads directory without requiring a save dialog.
Deep dive
Security firm Forever Security disclosed that it intercepted a live attack on a customer computer where an AI coding agent attempted to install a known malicious npm package after reading a planted AGENTS.md file inside the user's Downloads folder. Watkin Lab summarized the research on X in a post that drew more than 457,000 views, explaining how two standard software behaviors combine to turn plain text markdown files into an execution vector.
According to Forever Security researchers Gal Weizman and Omer Samet, any web page visited in Chrome, Edge, or Firefox can silently trigger an automatic download of a 13 kilobyte AGENTS.md or CLAUDE.md file into the local Downloads directory without user approval. Because roughly half of surveyed developer organizations have launched coding agents directly inside their Downloads folder to organize files or inspect archives, the agent automatically ingests the planted markdown file as trusted project instructions.
In controlled reproduction tests, a disguised AGENTS.md file instructed OpenAI Codex to register a malicious Model Context Protocol server in its global configuration file and bypass sandbox approvals, succeeding in more than 90 percent of test runs and persisting across future projects. Against Anthropic's Claude Code, a planted CLAUDE.md file instructed the agent to point its base API URL inside local settings to an attacker controlled server, leaking OAuth login tokens and allowing remote command injection in roughly 50 percent of tests. Both vendors advise developers to launch agents only inside dedicated project roots and inspect unfamiliar instruction files.
What to expect next
Because neither automatic browser downloads of plain text files nor an agent reading instruction files in its working directory is a traditional software vulnerability with a single patch, coding agent builders will likely add explicit blocklists for high risk directories such as Downloads and home folders. Until agent runtimes require interactive confirmation before loading newly created markdown instructions or modifying global MCP and API endpoint settings, engineering teams must treat untrusted folders as hostile execution environments.