On October 22, 2026, Forever Security said a malicious AGENTS.md file in a customer's Downloads folder led a coding agent to try installing the malicious npm package function-color. Codex ran the payload in more than 90% of test attempts.
At a glance
| Company | Forever Security, which caught the attack on a customer machine |
|---|---|
| Published | October 22, 2026 |
| Malicious package | function-color, an npm package linked to the MALFEX campaign |
| Codex result | Payload ran in more than 90% of attempts |
| Claude Code result | Chain succeeded about half the time |
| Vendor position | Forever says there is nothing for OpenAI or Anthropic to patch |
The signal
- On October 22, 2026, Forever Security reported that a planted AGENTS.md file in a customer's Downloads folder led Codex to try installing a malicious npm package, and it says there is nothing for OpenAI or Anthropic to patch.
- In Forever's tests, Codex ran the payload in more than 90% of attempts, and the Claude Code chain succeeded about half the time.
- Start coding agents from a project root instead of Downloads or a home folder, and review unfamiliar instruction files before an agent follows them.
- Check ~/.codex/config.toml for function-color or unfamiliar MCP servers, and rotate any tokens the agent held if you find them.
What happened
Forever Security said in its blog post that it stopped a coding agent mid-session as it tried to install function-color, a malicious npm package linked to the MALFEX campaign documented by Checkmarx. The order did not come from a dependency or a code repository. It came from an AGENTS.md file in the customer's ~/Downloads folder, which was also the agent's working directory. The planted file was a 13 KB document titled "Engineering Work Guidelines," with the attack hidden in one section near the end. That section told Codex to register a project-tools server in ~/.codex/config.toml, a machine-wide file that later sessions in any folder load.
The Forever Security writeup reproduced the chain on OpenAI's Codex. Codex ran the payload in more than 90% of attempts, mostly with a harmless calculator stand-in and once with the real package inside an isolated VM. The Claude Code test used a different route. A researcher-made CLAUDE.md pointed ANTHROPIC_BASE_URL in .claude/settings.json at a server the researchers controlled. That exposed Claude's OAuth token, which the team replayed against the real API and was served as the victim. The Claude chain succeeded about half the time, and a same-session subagent variant worked about a fifth of the time.
Forever did not establish how the customer's file arrived. It did show that a web page can write files into ~/Downloads, and BleepingComputer's verification of the proof-of-concept found that Chrome, Edge and Firefox do this without a prompt, while Brave asks first. Forever's position is that vendors have no fix to ship: "There is nothing here for OpenAI or Anthropic to patch." Reported scale also differs. Forever says about half of its customers run a coding agent in Downloads at least sometimes, while BleepingComputer quotes a researcher citing hundreds of customers.
By the numbers
| What | Figure | Source |
|---|---|---|
| Test attempts where Codex ran the payload | more than 90% | DEV Community |
| Claude Code sessions launched from Downloads | more than 1,300 | BleepingComputer |
| Open-source projects that use AGENTS.md | more than 60,000 | BetterClaw |
| Tools that read AGENTS.md files | more than 20 | BetterClaw |
| Size of the planted instruction file | 13 KB | DEV Community |
Figures exactly as published.
Timeline
Pillar Security showed that malicious instructions hidden in coding assistant rule files could slip harmful code into a project.
NVIDIA's technical blog published a case where a malicious dependency wrote an AGENTS.md file to make Codex hide a five-minute sleep, and OpenAI said the risk was not significantly higher than compromised dependencies.
A University of Washington study found that payloads planted in memory files can attack current and future sessions in Claude Code and Codex.
Forever Security published its writeup of the caught attack, including the Codex and Claude Code reproductions.
BleepingComputer published its coverage, including a verified proof-of-concept page that dropped a harmless AGENTS.md into Downloads.
“There is nothing here for OpenAI or Anthropic to patch.”
How a planted AGENTS.md leads to code execution
- 1Web page drops file
Chrome, Edge and Firefox can save a web download into ~/Downloads without asking, so a page can plant an AGENTS.md there.
- 2Agent reads the file
The agent runs from Downloads and follows the instruction file in its working folder as if the user wrote it.
- 3Config is rewritten
The hidden section tells Codex to register a project-tools server in ~/.codex/config.toml, which later sessions in any folder load.
- 4Payload installs
Codex installed the npm package function-color and ran the payload in more than 90% of test attempts.
Why it matters
For buyers, the attack works through intended behavior. Agents trust instruction files in their working folder by design, and browsers write downloads into Downloads without asking. The effect can outlast the file. The Codex change lives in machine-wide config, and deleting the markdown does not undo a write that already happened. A stolen OAuth token gives an attacker a live session, not just one captured request.
Exposure is wide. More than 20 tools read AGENTS.md, and more than 60,000 open-source projects use it. Claude Code can also read AGENTS.md in place of CLAUDE.md. Because vendors treat the behavior as designed, the controls fall to buyers. Claude Code supports organization-wide managed policy settings that sit above project files, which is where a fixed base URL belongs for an organization. The university study adds that memory-based payloads persist across sessions, so the review step has to cover files already on disk.
Who is affected
| Who | What changes | Impact |
|---|---|---|
| Security teams | Vendors treat this behavior as designed, so controls such as folder rules, approvals and sandboxes fall to buyers. | High |
| Developers who launch coding agents from Downloads | Anyone who starts Codex or Claude Code from Downloads is exposed, and Chrome, Edge and Firefox save downloads there without asking. | High |
| Organizations running Claude Code | Organization-wide managed policy settings sit above project files and are the right place for a fixed base URL. | Medium |
What to do now
For marketers
- Ask your engineering and developer relations teams which coding agents they run, and confirm none of them launch from Downloads or a home folder.
- Review any AGENTS.md or CLAUDE.md files your team publishes or shares so they contain only build steps, conventions, and boundaries.
- Update your security and developer-facing content to tell readers to start coding agents from a project root and keep approvals and sandboxes on.
- Brief your sales engineers and customer success managers on this issue so they can answer buyer questions about agent folder access.
- Check whether your own marketing or content teams use AI agents that browse or organize downloads, and set them to work from a dedicated project folder.
For software buyers and IT teams
- Audit ~/.codex/config.toml and ~/.claude settings on machines used for coding agents for function-color and unfamiliar MCP servers.
- Rotate any tokens a coding agent held on a machine where you find an unfamiliar server or package.
- Set organization-wide managed policy settings for Claude Code that fix the API base URL, since these sit above project files.
- Require that approval prompts and sandboxes stay enabled for every coding agent in your environment.
- Add a review step for unfamiliar AGENTS.md and CLAUDE.md files before any agent runs inside a project your team owns.
Printable, one page, 14 checks. Enter your email and it opens right away.
We email you a copy. We never share your email and never send you sales emails.
Pick one. It takes 5 seconds and helps more people find these briefings. Your checklist opens straight after.
Have a work email? Use it instead and the checklist opens straight away.
Open it, then save it as a PDF or print it.
Know someone who would find this useful?
These steps are our recommendations based on this news, not statements from the companies involved.
What to watch
- Launch agents from a project root, not from Downloads or a home folder. Review unfamiliar instruction files and keep approvals and sandboxes on.
- Audit ~/.codex/config.toml and Downloads for function-color and unfamiliar MCP servers. If it appears, rotate every token the agent held.
- The reported figures for customers running agents from Downloads differ.
Questions readers ask
What is an AGENTS.md file?
An AGENTS.md file is a Markdown file that tells AI coding agents how to work in a project, covering the stack, commands and code style. More than 20 tools read it, and more than 60,000 open-source projects use it.
How does a planted AGENTS.md file hijack a coding agent?
The agent trusts instruction files in its working folder, so it can follow hidden orders as if the user wrote them. In Forever's test, Codex ran the attacker's npm payload in more than 90% of attempts after a setup section told it to add a rogue server to its config.
Is Claude Code affected by the AGENTS.md attack?
Claude Code was hit through a related route, where a planted CLAUDE.md redirected its API traffic and exposed its OAuth token, and the chain succeeded about half the time. Claude Code can also read AGENTS.md in place of CLAUDE.md, so the same folder risk applies.
Who is affected by the Downloads folder attack on coding agents?
Anyone who launches a coding agent such as Codex or Claude Code from the Downloads folder is exposed. Chrome, Edge and Firefox save downloads there without asking, while Brave prompts first.
Should I let coding agents run from my Downloads folder?
No. Start coding agents from a project root instead of Downloads or a home folder, and review unfamiliar instruction files before an agent follows them. Keep approval prompts and sandboxes turned on as well.
How do I check if my computer has been affected?
Look in ~/.codex/config.toml for function-color or unfamiliar MCP servers, and rotate any tokens the agent held if you find them. Deleting the markdown file does not undo a config write that already happened.
Can OpenAI or Anthropic patch the AGENTS.md attack?
Forever Security says there is nothing for OpenAI or Anthropic to patch, because an agent that follows the AGENTS.md in its folder is working as designed. Buyers control the working folder, approvals and sandboxes, so those settings carry the defense.
Companies in this story
Sources
- DEV CommunityOriginal
- arxiv.orgOriginal
- BetterClawOriginal
- NVIDIA Technical BlogOriginal
- ForeverOriginal
- Claude Code DocsOriginal
- ChatGPT LearnOriginal
- BleepingComputer
- The Hacker News
- SaaStrAI
- TechCrunch
- Mashable SEA
Researched, fact-checked and edited by the Market Signal desk. Read our editorial standards. Spotted an error? Email hello@webvisiblity.com and we will correct it.