Quick heads up guys - if you launch Claude Code or Codex from your Downloads folder, stop. Forever Security found a real attack on a customer's machine. A plain AGENTS.md file had been dropped into Downloads, and it told the coding agent to install a malicious npm package. They then tested it on Codex. The agent ran the malware in more than 90% of attempts and even wrote the attacker's server into its global ~/.codex/config.toml settings. Claude Code has a similar weak spot. A project settings file can point ANTHROPIC_BASE_URL at an attacker's server and leak your login token. The uncomfortable part is that there's nothing to patch. The agent is doing exactly what it was built to do: read the instruction files in the folder it starts in. And Downloads is the one folder any web page can drop a file into without asking you. What I'm doing now: 1. Never start an agent in Downloads or any folder full of random files. 2. Read any AGENTS.md or CLAUDE.md I didn't write, including in freshly cloned repos. 3. Check ~/.codex/config.toml and .claude/settings.json for MCP servers or base URLs I don't recognise. 4. Keep approvals and sandboxing on. Your agent trusts the folder it opens in, so pick that folder carefully. Full write-up: