A text file in the Downloads folder can become a coding agent’s false set of working instructions. Gal Weizman and Omer Samet of Forever Security describe that risk in an October 22 report. They report tests in which planted Markdown instructions led Codex and Claude Code to change configuration and execute outside code or send login tokens to a test server.
The investigation began with a customer machine, the company says. An agent attempted to install a malicious npm package, which Forever Security says it blocked before code ran. How the instruction file arrived and exactly what the user had asked the agent to do remain undisclosed.
The team then reconstructed the attack chain. Its methods note matters: most tests used a harmless substitute that opened a calculator. The real malware was run once inside an isolated virtual machine, the researchers say. The report’s broad success figures therefore cannot be read as the rate of successful malware attacks on customers.
BleepingComputer covered the work on October 25 and checked whether a webpage could download a file with the relevant name. That did not independently reproduce the agent actions. The publication also noted download notifications and differences in browser approval prompts.
The researchers recommend avoiding the general Downloads folder as an agent workspace, reviewing unfamiliar instruction files and keeping approval gates and sandboxes enabled. The published material does not fully establish the effective user-approval boundary for the configuration changes. The warning concerns untrusted instructions, not demonstrated harm to every user of these products.