Malicious AGENTS.md / CLAUDE.md in my Downloads folder hijacked my AI coding agent (Codex, Claude Code, Cursor CLI): how do I check if I was hit and prevent it?

What happened: Forever Security reported (October 22, 2026; covered by BleepingComputer on October 25) that a web page can get a browser to save an AGENTS.md or CLAUDE.md file into ~/Downloads without a prompt. If you later start a coding agent in ~/Downloads, or in a parent folder like your home directory, the agent loads that file as trusted project instructions. In a real customer incident the planted instructions led an agent to try to install a rogue npm package. In tests, the researchers got Codex to follow planted instructions most of the time, and got Claude Code to send its API traffic through an attacker server, exposing its OAuth token. OpenAI and Anthropic say there is nothing to patch: agents are meant to follow instruction files in their working folder. The fix is in how you run them. Am I at risk? If you start Codex, Claude Code, Cursor CLI or a similar agent from ~/Downloads, your home folder, or any folder a browser or other program can write into. Check if you were hit: - Look for AGENTS.md, CLAUDE.md or other agent instruction files you didn't create in ~/Downloads, your home folder and recently cloned repos (ls -la ~/Downloads | grep -i -E 'agents|claude'). - Codex: look for unexpected [mcp_servers.*] entries or changed settings in ~/.codex/config.toml. - Claude Code: look for an ANTHROPIC_BASE_URL or other unexpected env/apiKeyHelper settings in ~/.claude/settings.json and project .claude/settings*.json files, and for MCP servers you didn't add. - Check global and project npm installs for packages you didn't intend; the researchers named function-color as the package in the observed incident. If anything is there: delete the file, restore the config, sign out of the agent and sign in again (claude /logout then /login; codex logout/login), and rotate API keys and tokens the agent could reach (npm, GitHub, cloud, .env secrets). Prevent it: - Only start agents from a specific project folder, never from ~/Downloads or ~. - Read unfamiliar AGENTS.md / CLAUDE.md files before running an agent in a folder you didn't write. - Keep approval prompts and sandboxing on; be wary of instructions asking you to disable them. - Optionally point the browser's download folder somewhere else, or ask before saving each download. - Open untrusted code in a container or VM. Sources: https://forever.security/blog/hijacking-ai-agents-via-downloads-folder/ https://www.bleepingcomputer.com/news/security/ai-coding-agents-hijacked-using-agentsmd-file-in-downloads-folder/