AI coding agents fall for malicious instructions planted in the Downloads folder

Forever Security reported that attacker-supplied AGENTS.md and CLAUDE.md files placed in the Downloads folder can trick AI coding agents (notably OpenAI Codex and, to a lesser extent, Anthropic Claude Code) into installing malicious npm packages or sending the user's login token to an attacker; researchers observed the malicious npm package “function-color” in an active campaign and recommend avoiding running agents from Downloads, auditing instruction files, keeping sandboxes and approval prompts enabled, and rotating credentials if a planted file is found.