Critical Flaw in OpenAI Codex, Claude Exposes Users to Code Injection

Key Takeaways

• A critical vulnerability allows malicious plain text files in the Downloads folder to manipulate AI coding agents like OpenAI Codex and Anthropic Claude.
• The flaw, impacting versions of Codex and Claude Code, enables attackers to inject commands, install malware, or exfiltrate sensitive data such as OAuth tokens.
• The attack leverages the agents’ default behavior of reading configuration files (e.g., AGENTS.md, CLAUDE.md) from the current working directory, including the Downloads folder.
• While user interaction is required to initiate the agent in the compromised directory, the vulnerability can lead to persistent compromise and remote code execution.

AI Coding Agents Vulnerable to Code Injection via Downloads Folder

Cybersecurity researchers have uncovered a critical vulnerability in leading AI coding agents, including OpenAI Codex and Anthropic Claude Code, that could allow attackers to inject malicious code, install malware, or steal sensitive user tokens. The flaw exploits the agents’ tendency to read configuration or instruction files from the user’s Downloads folder, a common location for untrusted web content.

The discovery was made by Forever Security after their systems intercepted an AI coding agent attempting to install a known malicious npm package on a customer’s machine. Subsequent investigations and controlled tests confirmed the existence of distinct attack vectors against both OpenAI Codex and Anthropic Claude Code.

The Genesis of the Attack: Malicious Markdown in Downloads

The incident began when Forever Security’s defenses blocked an AI coding agent from installing an npm package named function-color. Tracing the command, investigators found its origin in an AGENTS.md file located within the customer’s ~/Downloads directory. This file, despite appearing to be a standard set of engineering notes, contained carefully crafted instructions designed to alter the agent’s configuration and trigger the package installation.

Although the initial source of the malicious AGENTS.md file remains unconfirmed, researchers demonstrated that a similar file could be delivered to a user’s Downloads folder through typical browser download mechanisms, establishing a plausible pathway for exploitation. The danger stems from the combination of an AI agent’s trust in instruction files and the Downloads folder, where operating system security checks often overlook plain text files as non-executable threats.

AGENTS.md files function much like READMEs for AI tools, providing project rules, commands, and operational instructions that OpenAI’s documentation states Codex reads before commencing work. Similarly, Claude Code utilizes CLAUDE.md files for analogous purposes, parsing them at the start of a conversation.

It is important to note that this attack is not entirely automated. It requires the victim to either run the coding agent directly from the Downloads folder or configure it to process the malicious instruction file. Furthermore, the agent must possess sufficient permissions to modify files, execute commands, access the internet, or install software. Therefore, security measures such as approval prompts and sandboxing can significantly reduce the likelihood of a successful exploit.

Codex Attack Achieves Persistence and Malware Installation

In Forever Security’s controlled tests, OpenAI Codex was successfully manipulated in over 90% of attempts. The malicious instructions compelled Codex to add an MCP server entry to its machine-wide configuration file, ~/.codex/config.toml. This action then initiated a second Codex session with crucial security features, including approval and sandbox checks, deliberately disabled.

This configuration change established persistence, allowing subsequent Codex sessions to load the rogue server even if the user moved to a different project directory. While most tests used benign programs, the real malicious package was executed once within an isolated virtual machine. The package, function-color, is associated with MALFEX, an ongoing npm malware campaign targeting Windows developers. This campaign is known for delivering remote-access malware and exfiltrating sensitive data from browsers, Discord, Telegram, and cryptocurrency wallets.

Claude Code Vulnerability Leads to Token Exposure

Anthropic Claude Code required a different exploit method. Researchers crafted a malicious CLAUDE.md file instructing Claude to write an ANTHROPIC_BASE_URL value into its .claude/settings.json configuration. This redirection rerouted Claude’s API traffic to a server controlled by the researchers, thereby exposing OAuth tokens transmitted with the requests.

Forever Security reported that Claude made this critical configuration change in approximately half of their tests. By replaying a captured token against Anthropic’s service, the research team successfully gained unauthorized access as the victim. In some instances, the fake server also returned tool commands that resulted in code execution, with same-session execution via a helper agent succeeding in about 20% of cases.

This research underscores a growing concern regarding instruction files and add-ons as potential software supply-chain risks. Previous studies have demonstrated how malicious agent skills targeting Claude Code and Codex could evade automated scanning tools, highlighting the evolving threat landscape for AI-powered development environments.

What You Should Do

• Avoid Running Agents in Downloads: Developers should never initiate Codex, Claude Code, or any other coding agent from within the Downloads directory.
• Review Unknown Instruction Files: Before allowing an agent to access any folder, carefully review unknown AGENTS.md or CLAUDE.md files for suspicious content.
• Maintain Security Controls: Keep approval checks and sandboxing features enabled for all AI agents. Limit agent network access to only necessary resources and avoid instructions that request unsafe bypass options.
• Inspect Configuration Files: Security teams should regularly inspect ~/.codex/config.toml for unknown MCP server entries and review .claude/settings.json for any unfamiliar ANTHROPIC_BASE_URL or proxy settings.
• Respond to Compromise: The discovery of function-color, unexpected agent settings, or redirected API traffic should be treated as a potential compromise. Immediately revoke affected tokens and connected credentials from a clean device. Isolate the compromised system and conduct a thorough malware scan.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.