Researchers demonstrate coding-agent attacks through downloaded instruction files

Forever Security researchers reproduced an attack that used a malicious instruction file in a Downloads folder to make OpenAI Codex execute code, BleepingComputer reported. They also demonstrated a related Claude Code attack that exposed an OAuth token and enabled account hijacking. The investigation began after a customer's agent attempted to install a rogue npm package. Coding agents load instruction files from their working directories, allowing attacker-written text to influence tool use. A harmless Codex test opened a calculator in 90% of attempts. The Claude Code technique redirected API traffic and executed code in roughly 50% of tests. The Downloads attack requires launching the agent in that directory; researchers could not establish how the original malicious file arrived.