Breaking

Researchers Show How Files in Downloads Can Steer Codex and Claude Code

October 26, 2026 at 13:42 EDT

Security
AI Agents

A malicious instruction file in a customer’s Downloads folder prompted an AI coding agent to attempt installing a known malicious npm package, according to security firm Forever Security. Researchers say they reproduced related attacks against OpenAI Codex and Anthropic’s Claude Code, showing how files treated as project guidance can steer agents with access to local tools and credentials.

OCTOBER 22, 2026 · SECURITY

A download can steer a coding agent

An instruction file in an agent’s working folder can influence settings or API traffic, creating paths to malware execution or credential exposure.

Reported results from separate tests

Each block marks 10 percentage points. These were different attack demonstrations, not a head-to-head benchmark.

Codex

>90%

Claude Code

~50%

Codex: more than 90% reported. Claude Code: about 50% in a separately constructed test.

How the chain works

An instruction file reaches a working folder

→

An agent opens that folder and reads it

→

Settings or API routing may change

Exposure depends on context

The agent must process the file in its working folder, and its available permissions shape the impact.

Keep the working area narrow

Use a project folder, review unfamiliar instruction files, and keep approval and sandbox controls enabled.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.