Research team hijacks AI coding agents using AGENTS.md in the Downloads directory

Forever Security found a malicious AGENTS.md file in the ~/Downloads directory on a customer's computer, which lured AI coding agents into installing the malicious npm package function-color. The researchers reproduced the attack on OpenAI Codex, and used a malicious CLAUDE.md to redirect Claude Code's API traffic to a controlled server to steal OAuth tokens; in testing, code execution succeeded about 50% of the time, and the success rate for the harmless payload test against Codex was 90%. The researchers noted that browsers can silently write files to ~/Downloads, and recommended against setting that directory as an agent's working directory, and checking unfamiliar instruction files such as AGENTS.md and CLAUDE.md before running.