Codex obeys planted file in 9 of 10 tests
A hidden instruction file in a computer's Downloads folder made OpenAI's Codex run an attacker's program in more than 9 of 10 tests, Forever Security said on the 22nd of October 2026. Anthropic's Claude Code fell for a similar file about half the time.
OpenAI's Codex and a planted fileA hidden file in the Downloads folder can make AI coding tools run an attacker's program, Forever Security said on the 22nd of October 2026. OpenAI's Codex followed the file in more than 90 percent of tests, the security firm wrote.
Anthropic's Claude Code fell for a similar file about half the time, Forever said. The firm first found the trick on a real customer's computer.
What a coding agent and an AGENTS.md file are
A coding agent is an AI tool that writes and runs code on a computer by itself. It obeys an instruction file, called AGENTS.md or CLAUDE.md, in the folder where it starts.
A website can save a file to the Downloads folder without a click, Forever wrote. If the agent starts in that folder, it obeys the planted file.
What the file made OpenAI's Codex do
The real file told Codex to change its own settings and install a harmful program named function-color, Forever said. The change then loaded in every later Codex session on that computer, the firm wrote.
What a similar file did to Anthropic's Claude Code
Forever wrote its own CLAUDE.md that sent Claude Code's traffic to a server Forever ran. That handed over Claude Code's login token, a digital key to the user's account.
Below we break down the test results
BleepingComputer reported on the 25th of October 2026 that Codex followed the file in 90 percent of tests. Claude Code was started from Downloads more than 1,300 times among Forever's customers, a researcher told the site.
What users should do
Never start a coding agent in the Downloads folder, Forever said. Read any AGENTS.md or CLAUDE.md file you did not write, and keep approval prompts switched on.
What is confirmed and what is not
Forever said OpenAI and Anthropic have nothing to fix, since the tools work as built. Both companies advise starting an agent inside its own project folder, BleepingComputer reported.
Key facts
Forever Security published the research on the 22nd of October 2026.
A planted AGENTS.md file can steer AI coding tools.
The trick worked on Codex and Claude Code.
Forever advises never starting an agent in Downloads.