Malicious AGENTS.md in Downloads hijacks AI coding agents
Forever Security showed a web-dropped AGENTS.md in ~/Downloads makes Codex install an npm backdoor in 90% of tests; a CLAUDE.md variant leaks Claude Code's OAuth token. No patch to apply.
Forever Security showed a web-dropped AGENTS.md in ~/Downloads makes Codex install an npm backdoor in 90% of tests; a CLAUDE.md variant leaks Claude Code's OAuth token. No patch to apply.