‼️ Hackers Can Hijack OpenAI Codex and Claude Using Malicious Files in the Downloads Folder Details: cybersecuritynews.com/codex-… A plain text file placed in the Downloads folder can trick AI coding agents into changing their settings, installing malware, or exposing login tokens. The incident began when Forever Security blocked an AI coding agent from installing a package named function-color. Investigators traced the order back to an AGENTS.md file stored in the customer’s ~/Downloads folder. An AGENTS.md file is similar to a README written for AI tools. OpenAI’s documentation says Codex reads these files before starting work and uses them to learn project rules, commands, and other instructions. Claude Code uses CLAUDE.md for a similar purpose and reads it at the start of a conversation. #CybersecurityNews