Poisoned AGENTS.md files can hijack Claude Code and Codex sessions
A Japanese developer post with about 3,706 likes lays out a simple attack chain against coding agents.
Developer @tegnike outlined an attack chain early Tuesday: visiting a hacker's website silently downloads an AGENTS.md file into the Downloads folder.
If the user then starts a Claude Code or Codex session inside Downloads, the agent loads the attacker's AGENTS.md as its starting context, so the attacker's instructions shape what the agent does.
Why it mattersAgent instruction files are trusted by default. The post is a reminder not to launch coding agents from folders that collect untrusted downloads.
