Malicious Markdown Files Hijack AI Agents Codex and Claude
First merged summary.
Forever Security says planted AGENTS.md can hijack Codex and Claude to install malware or leak tokens.
Forever Security identified a malicious markdown file in a customer's downloads folder that could abuse the trust AI coding agents place in local files. The file, disguised as engineering notes, instructed Codex to install the function-color npm package and create a persistent MCP server while disabling approval checks in over 90 percent of lab tests. A CLAUDE.md variant redirected API traffic and exposed an OAuth token in roughly half the runs. The attempt was stopped before any code executed, and the file's origin remains unknown.
- AGENTS.md in downloads folder tricked agents into installing malware or leaking tokens
- Codex added MCP server to ~/.codex/config.toml in >90% of tests
- Claude Code exposed OAuth token in ~50% of CLAUDE.md tests
- Attack stopped before code ran on customer machine
- function-color npm package tied to MALFEX group
- Malicious website download noted as possible delivery vector
What each outlet adds
beyond the shared facts- Cyber Security NewsDetailed lab tests with success rates and specific config changes for both Codex and Claude
- Dark ReadingIdentified as in-the-wild attack with malicious website as delivery path
- Products
- CodexClaude Code
- Organizations
- Forever SecurityCheckmarx
Coverage
oldest first · one row per article · UTC- · 6d ago
Cyber Security NewsFirst report
Malicious Downloads files can hijack Codex and Claude Code
Forever Security says a planted AGENTS.md or CLAUDE.md can change agent settings, install an npm package, or expose an OAuth token.
- · 6d ago
Dark Reading
Malicious AGENTS.md tried to hijack coding agents
Forever Security says a planted markdown file on a customer PC could push Codex to install malware or leak tokens, and was stopped before code ran.