Claude Code Bypass Rate Near Half in Malware File Tests
Forever Security shows what malware.ai looks like in practice: planted instruction files in Downloads that push AI coding assistants to run harmful commands and install rogue packages.
Forever Security traced AI coding agents obeying planted AGENTS.md files in a user’s Downloads folder, not a normal project dependency.
In tests, OpenAI’s Codex followed the hidden directives over 90% of the time; Anthropic’s Claude Code succeeded in roughly half of trials.
The risk is by design: agents are built to read plain-text instruction files such as AGENTS.md or CLAUDE.md when started in a folder.
Browsers can save files to Downloads without prompts, and many developers launch agents from that folder while browsing.
Advice: do not start agents in Downloads, check config for rogue servers or base URLs, and review unfamiliar Markdown instruction files.