Rogue AGENTS.md in Downloads Can Hijack AI Coding Agents

Security firm Forever Security found a malicious AGENTS.md file sitting in a customer’s Downloads folder, instructing an AI coding agent to install a malicious npm package. In follow-up tests, the same technique got OpenAI Codex to run malware and led Claude Code to leak its login token.

A planted file on a real customer machine

AGENTS.md is a plain Markdown file that gives coding agents project instructions: which tools to use, how to run tests, which coding conventions to follow. Agents such as Codex read it from their working folder and act on it. Claude Code uses a similar file called CLAUDE.md.

In a report published on October 22, 2026, Forever researchers Gal Weizman and Omer Samet describe how their software stopped an agent that was about to install an npm package called function-color on a customer’s computer. The instruction came from an AGENTS.md stored in the customer’s ~/Downloads folder. It was written to look like routine engineering notes, so nothing about it stood out to the agent. The attack was blocked before any code ran.

function-color was already known. In a report dated October 5, 2026, Checkmarx tied it to an npm malware campaign it calls MALFEX. The operator behind it published 12 packages, eight of them malicious, with 40,767 lifetime downloads as of October 1, 2026. According to The Hacker News, function-color pulls in a downloader package, function-flag, which fetches and runs a Windows payload. Forever says npm has since removed the package.

The researchers could not determine how the file reached the customer’s Downloads folder. To test one plausible route, they built a proof-of-concept web page that saved an AGENTS.md into Downloads with no click and no permission prompt.

How an instructions file takes over an agent

Forever then tested two widely used coding agents. The results differed, but both could be steered.

OpenAI Codex

Inside an isolated virtual machine, the researchers ran the attacker’s real AGENTS.md. Codex ran the malware in more than 90% of attempts. The file got Codex to edit ~/.codex/config.toml, a machine-wide configuration, adding an MCP server controlled by the attacker. MCP servers are add-on services that give an agent extra tools. Because the configuration is global, the rogue server loads in every later session and every project.

To get past the network sandbox, the payload launched a child codex exec run with the --dangerously-bypass-approvals-and-sandbox flag. Forever says the model wrote that flag on its own. The report lists five safeguards the payload worked around, including the folder trust gate and the network sandbox.

Claude Code

Claude Code was harder to fool. The researchers wrote their own CLAUDE.md asking the agent to add ANTHROPIC_BASE_URL to the project’s .claude/settings.json. That setting redirects Claude Code’s API traffic to a server the researchers controlled. The write was approved in about half of the attempts.

Once traffic was redirected, the OAuth token that signs the user in to Claude went along with it. The researchers replayed the token against Anthropic’s real API to demonstrate account takeover. Code execution followed on the next launch, or in the same session about one time in five. Forever also notes that a subagent reading the file flagged it as an attack, so the file had to be long and bland, like ordinary engineering documentation.

Why the Downloads folder matters

BleepingComputer notes that Chrome, Edge, and Firefox save downloads to ~/Downloads by default and only show a notification. Brave asks for approval before saving. A crafted web page can therefore place a file named AGENTS.md in that folder without the user noticing.

The risk materializes when someone opens an AI agent in that same folder, for example to tidy up downloads or work on a file they just fetched. Forever’s telemetry shows that about half of its customers run a coding agent inside Downloads, and that roughly a quarter of agent sessions open a real browser.

Forever sums up the finding in one line: “Markdown is the new executable.” A text file that looks harmless now behaves like a program, because the agent reading it has permission to run commands, install packages, and change settings.

The researchers also argue that OpenAI and Anthropic have nothing to patch, since agents reading instructions files in their working folder is the intended behavior. They compare it to a phishing page: the browser works as designed, and the attack lives in the content. BleepingComputer’s report carries no statement from OpenAI or Anthropic. According to the same report, both vendors recommend starting agents from the root of the project being worked on.

The pattern resembles ClickFix scams, which trick people into running commands themselves, as covered in our article on Chrome’s ClickFix warnings. The difference here is that the target is an AI agent acting on the user’s behalf.

What this means for development teams

Coding agents are now common in software houses, startups, and in-house IT teams at banks, hospitals, and government agencies. Anthropic, as described in our article on Scion, recorded more than 30,000 code merges a day in September 2026 as agents wrote a growing share of its code. Any agent with terminal access also inherits its developer’s privileges: API keys, cloud tokens, and repository access.

Steps teams can take now, based on Forever Security’s guidance:

1. Never start an agent in Downloads. Avoid broad folders such as your home directory as well. Launch agents from the root of the project you are actually working on.
2. Read instructions files you did not write. Review AGENTS.md, CLAUDE.md, and similar files before an agent follows them, including in freshly cloned repositories.
3. Audit agent configuration. Look for unfamiliar [mcp_servers.*] blocks or a changed chatgpt_base_url in ~/.codex/config.toml. In projects, check .claude/settings.json for ANTHROPIC_BASE_URL or any API endpoint you did not set.
4. Keep approvals and sandboxes on. Be wary of any instruction asking the agent to disable them.
5. Rotate credentials if in doubt. If you find a planted file, or function-color was ever installed, assume the token leaked and issue a new one.

For organizations, these steps belong in written policy that applies to every developer. Security teams can add agent instructions files and MCP configuration to developer workstation audits, and monitoring which packages get installed on developer machines helps catch malicious ones before they reach a project. Policies like these can be built with a cybersecurity services partner or folded into the workflow of a web development team.

Frequently asked questions

Do Codex and Claude Code have a vulnerability?

Forever Security says there is no bug to patch. Agents read instructions files in their working folder by design. The risk comes from the combination of browsers that save files automatically and agents launched inside the downloads folder.

Are other AI agents affected?

Forever only tested Codex and Claude Code, but says the problem applies to coding agents in general. Any agent that reads instructions from its working folder and is allowed to run commands deserves the same caution.

How can I tell whether my machine was affected?

Look for an AGENTS.md or CLAUDE.md in your Downloads folder that you did not create, then check ~/.codex/config.toml and .claude/settings.json for unfamiliar server addresses. The presence of the function-color package among installed packages also suggests the machine may be compromised.

Conclusion

Forever Security’s findings show that plain text files need to be treated like programs once an AI agent is reading them. If your team is adopting coding agents and wants clear rules for using them safely, Merakit can help review your workflows and configurations.

Sources

• Forever Security: Markdown Is the New Executable: Attackers Are Dropping Agent Instructions Into Your Downloads Folder From the Web (October 22, 2026)
• BleepingComputer: AI coding agents hijacked using AGENTS.md file in Downloads folder (October 25, 2026)
• The Hacker News: Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware (October 26, 2026)
• Checkmarx: MALFEX npm malware campaign, three payloads and an adversary that signs their work (October 5, 2026)