One of Forever Security’s customers had a file sitting in Downloads that nobody could account for: an AGENTS.md, a plain text instruction sheet, telling OpenAI’s Codex to pull an npm package called function-color. The firm’s software caught the install before anything ran.
Thirteen kilobytes of text that reads like ordinary engineering conventions is what got through. Such a file carries authority for Codex only inside a directory it has been told to trust, and once a developer has worked in Downloads, that folder counts. Open it in that directory with any task at all, and Codex rewrote its own MCP server settings machine-wide before fetching the package.
Gal Weizman and Omer Samet, the researchers behind the finding, put success at over 90 percent of tries, using mostly a harmless substitute. Because the settings apply machine-wide, each later Codex session follows the planted command no matter which project gets opened.
The unguarded text file
Downloaded executables wait for the user’s approval before they run. A text document meets no such gate, and Codex reads the format by design, so trust grew with no control to match.
The pair then wrote a CLAUDE.md for Anthropic’s Claude Code. Claude resisted more, and the method that worked shared nothing with Codex: the file asks the agent to save a settings change dressed up as a corporate gateway, pointing API calls at a researcher-run server. It worked in roughly half the tests, and each call carried the user’s login token, which the pair replayed to seize the account without executing code.
Treat instruction files as hostile: keep agents out of download folders, audit machine-wide agent settings, and rotate tokens wherever an AGENTS.md or CLAUDE.md turned up unexplained.
