What was described
According to the account published by the security company Forever Security and reported by QbitAI, a simple Markdown text file called AGENTS.md, or its CLAUDE.md variant, can turn into an attack vector when it ends up in the user's Downloads folder. The file would not contain executable code, but natural-language instructions that programming assistants are designed to read and follow as project context.
The novelty would not lie in the use of a malicious prompt per se, but in the exploitation of a legitimate feature: agents such as Codex and Claude Code read the instruction files present in the working directory to adapt their behavior. A file downloaded and then opened in that same directory would be treated as authoritative documentation, even if its author is external.
The two attack chains
In the case of Codex, the instructions contained in the file would induce the agent to register a tool server in the user's global configuration and to run a process with the option that disables approvals and the sandbox. Because the modification would affect the configuration of the entire machine rather than that of the individual folder, a malicious service could be reactivated on every subsequent startup, even in different projects.
For Claude Code, by contrast, the described attack would aim to rewrite the project settings to redirect requests to a gateway controlled by the attacker. In this way the access token would be sent to the external server; the forged response would in turn contain a command that disables the sandbox. Forever Security documented the chain in a YouTube video and in a post on its blog.
The scope and limitations
The central thesis is that the agents' behavior would not depend on a software vulnerability, but on the intended use of the features: reading local instructions and executing the suggestions. The risk would mainly concern users who work with repositories or archives downloaded from third parties and who have granted the agent broad permissions, including executions without confirmation.
The reproducibility of the chain, the product versions involved and the number of real-world cases remain to be independently verified. The practical recommendations cited consist of checking for the presence of the files in the Downloads folder and on the desktop, verifying the global configurations for anomalous entries, examining the settings of individual projects and, in case of suspicion, revoking and regenerating tokens. These are measures suggested by the source, not an assessment certified by third parties.
