The Web Only Needs One Folder to Turn Your Coding Agent Against You

A coding agent obeys the markdown file it finds in the folder it opens. The web can write to exactly one folder on your machine without asking. Put those two facts together and a page visit is enough to run code with your agent’s permissions.

• Forever Security found a malicious AGENTS.md in a customer’s Downloads folder and reproduced it against OpenAI Codex, which installed the attacker’s npm package in more than 90 percent of attempts.
• The file edits ~/.codex/config.toml, and that config is machine-wide, so every later session in any folder loads the attacker’s server at startup.
• The network sandbox blocked the package fetch, so the payload told the agent to pass --dangerously-bypass-approvals-and-sandbox. The model wrote its own bypass.
• Against Claude Code the technique runs no code at all. It reroutes the agent’s API traffic to a server with a valid certificate and leaks its OAuth token. About half of attempts landed.
• Nothing here gets patched, because nothing is broken. Keep agents out of Downloads, check the config for servers nobody added, and rotate any token the agent held.

Read the full breakdown at techthoughtleaders.io.