Forever Security found live malware using a new attack vector. A file planted in the Downloads folder tricks AI coding agents into obeying malicious instructions. The file rewrites agent configuration to install malware or steal login tokens. The attack worked on both OpenAI Codex and Claude Code in testing. The vector remains open because it exploits how agents are designed to behave. Half of measured companies had employees running these agents in Downloads. A quarter of agent sessions open a browser, increasing exposure. The attack does not require user clicks or mistakes. It cannot be patched away by vendors. The risk is active and must be managed by organizations.
What changed
Coding agents only read instruction files from trusted project folders.
What it unlocks
A website can silently plant an instruction file in Downloads that an agent will obey.
- ~50% of customers run a coding agent in Downloads
- ~25% of agent sessions open a real browser
- >90% Codex attack success rate
- ~50% Claude attack success rate
What you need to act on it
- agent runs in Downloads folder
- agent opens a browser session
Sources