Malicious AGENTS.md file hijacks AI coding agents, installs rogue npm package

A malicious AGENTS.md file placed in a user's Downloads folder instructed OpenAI Codex and Claude Code to install a rogue npm package, leaking OAuth tokens and hijacking the account. Researchers at Forever Security demonstrated the technique, showing that AI coding agents automatically load such instruction files from their working directory.