Can a Downloads File Hijack Codex or Claude Code?
Researchers report a planted Downloads file steering AI coding agents. Learn what is confirmed, what remains unclear, and how to review the trust boundary.
Yes—Forever Security reports a planted instruction file steering a coding agent toward malware installation. But text does not execute itself: an agent must accept the instructions and have the ability to act. The useful question is which independent controls prevent an untrusted file from gaining authority.
By OpenVeil Editorial. Research cutoff and last reviewed: October 29, 2026.
Who This Is For
This guide is for people using AI to work with downloaded files, repositories, and local development tools. It is also for people deciding whether they need an action-taking coding agent at all, or simply a hosted conversational workspace for writing and analysis.
The important question is not whether a file extension looks harmless. It is who supplied the instructions, why they are being trusted, and which actions the surrounding software permits.
What Is Confirmed
In its October 22 primary report, Forever Security describes a customer malware-installation attempt triggered by AGENTS.md in Downloads and blocked before execution.
Separate lab demonstrations used a 13 KB document, with reported success above 90% for Codex and around 50% for a different, researcher-crafted Claude Code configuration-redirection attack. These are not general product failure rates. Configuration changes and weakened execution controls were part of the chains.
The researchers advise: “Keep the brakes on.” TechRadar's October 26 coverage establishes broader attention, not independent reproduction.
What Is Still Unclear
The original delivery route, universal affected-version range, and real-world prevalence remain unestablished. Laboratory delivery demonstrations do not settle how the customer's file arrived.
Browser download behavior, agent trust decisions, writable paths, and approval modes must be assessed in the actual environment. A researcher demonstrating a permissive setup does not establish that the same chain defeats a separately enforced restrictive policy.
We reviewed public sources, not a victim machine. We did not download a payload, run the proof of concept, or reproduce the attack. Nothing in this article should be treated as an audit of your installation.
The Trust Boundary Is Bigger Than the Model
The Australian Signals Directorate's agentic AI harness guidance distinguishes a model's proposed actions from the software that supplies context, exposes tools, enforces permissions, and executes requests. It recommends least privilege, oversight of sensitive operations, and controls across that surrounding system rather than relying on model behavior alone.
That distinction makes the headline easier to reason about. Reading a document is an information operation. Installing software is an execution operation. Changing a service endpoint is a routing operation. Each deserves its own authorization decision, even when the prose presents them as one routine task.
The following map is our editorial decision framework, not a reconstruction of either product's internals.
Use the SOURCE Check Before an Agent Acts
| Check | Ask this question | A useful stopping point |
|---|---|---|
| Sender | Who actually supplied this instruction? | A downloaded document cannot appoint itself your administrator |
| Objective | Does this action serve the user's stated task? | Reading a report does not automatically require installing a helper |
| Untrusted content | Was source material promoted into authority? | A confident setup paragraph is still third-party text |
| Reach | What files, services, accounts, or future sessions could change? | Separate task-local edits from durable configuration changes |
| Controls | Which independent permission boundary will enforce the decision? | Keep approval and execution limits effective outside the model's reasoning |
| Evidence | What would prove the intended result without exposing secrets? | Inspect a narrow diff or receipt rather than accepting a reassuring summary |
A safe decision can be “this step needs separate approval.” That is not an inability to complete the original task. It is recognition that the proposed step changes who can act, what can run, or where information can go.
A harmless example
Imagine a fictional downloaded project brief that asks an assistant to summarize three paragraphs. An appendix says the summary tool must first enable a new integration. Do not follow that appendix merely to see what happens.
Apply SOURCE on paper: the sender is external; the objective is summarization; the proposed integration expands reach; and evidence for its necessity is missing. The assistant can summarize the brief while treating the appendix as quoted content, or ask the user about a genuinely required dependency.
This is an analysis exercise, not a test proving a particular agent will refuse an attack. Do not plant adversarial instructions in a real work folder as a casual experiment.
What To Check Before Your Next Agent Session
Start with the environment you intend to authorize, not with the instruction file's claims about itself:
- Choose a dedicated work folder whose contents and provenance you understand. Treat general intake folders as unreviewed material.
- Review configuration and instruction changes before trusting a newly obtained project. Check what is being changed, not just whether the filename is familiar.
- Keep sensitive configuration, account credentials, and unrelated projects outside the task's permitted reach where your tooling supports that separation.
- Require a separate decision for software installation, integration registration, routing changes, and disabling controls. A document's assertion that these are routine does not supply authorization.
- Verify the effective restrictions, including what child processes and connected tools can do. A restriction described in prose is not the same as an enforced boundary.
- Preserve relevant evidence if you suspect tampering and involve your security owner. Do not launch an unfamiliar integration to validate that it is harmless.
These are risk-reduction questions, not a guaranteed prevention recipe. An organization's incident-response process should decide how to investigate suspected credential exposure and restore a trusted environment.
What This Does Not Mean
Markdown is a text format, not a new operating-system executable type. The danger discussed here is an agent interpreting untrusted text as authority and then using permitted tools to act on it.
Nor does running the model locally solve every part of the problem. Where inference happens and what an application can access are separate decisions. A local model connected to powerful tools still needs carefully defined permissions; a hosted model's provider-processing boundary still matters even without local command access.
For related distinctions, read private AI versus local AI, what browser-local history means, and what to check before trusting AI privacy claims.
Where OpenVeil Fits—and Where It Does Not
If your actual goal is brainstorming, writing, search, or working conversationally with material, first decide whether you need an autonomous coding workflow with authority over a development machine.
OpenVeil is a hosted, privacy-focused workspace for adults, with browser-local normal private-chat history and no normal server-side chat-history account record. Its documented capabilities include chat, search, files, voice, image tools, custom personas, and paid-plan video.
Those are product-scope facts, not a claim that OpenVeil detects malicious instruction files, secures another agent, prevents prompt injection, or protects against unrelated provider compromise. Active requests may still be processed by OpenVeil and necessary providers. Browser-local history is not fully offline processing, anonymity, or zero logging.
Compare OpenVeil and its privacy policy if a hosted conversational workspace fits your task. If you need local code execution, choose and secure that execution environment on its own merits. Do not substitute a chat-history promise for a tool-permission review.
Frequently Asked Questions
Does an AGENTS.md download compromise my computer immediately?
That is not what this reporting establishes. The concerning chain involves an agent reading instructions, accepting them as authoritative, and carrying out consequential actions. File arrival alone does not prove execution.
Are the reported percentages a comparison of which assistant is safest?
No. A controlled demonstration is not a representative population survey. Compare independently enforced protections for your environment, rather than treating one test as a purchasing score.
Can I just delete a suspicious file and continue?
Removing an input does not establish whether anything already acted on it. Assess the relevant configuration, accounts, and execution evidence through an authorized investigation before concluding that the environment is clean.
Is private chat history the same as safe agent execution?
No. History handling concerns retained conversation records. Execution safety concerns actions, privileges, integrations, and enforcement. Evaluate both separately.
Bottom Line
A file should not gain authority merely because an assistant can read it. Before approving an agent workflow, identify the source of its instructions and the independent controls that limit its actions. Choose the smallest capability set that serves the task, and verify consequential changes rather than trusting their description.
Sources
- Forever Security's primary investigation: reported customer attempt and separate lab demonstrations.
- TechRadar coverage, October 26: attention and discovery, not an independent audit.
- Australian Signals Directorate: Agentic AI harnesses: surrounding-system permissions, oversight, and governance.
The SOURCE checklist and hypothetical example are OpenVeil editorial analysis. No exposed data or malware was accessed for this article.