A planted AGENTS.md in Downloads steered Codex toward malware, Forever Security says

Coding agents such as OpenAI’s Codex and Anthropic’s Claude Code read an instructions file (AGENTS.md or CLAUDE.md) in the folder they start in, and follow it. Security firm Forever Security says it found an attacker using exactly that: a malicious AGENTS.md sitting in the ~/Downloads folder of a real customer machine, dressed up as a long “Engineering Work Guidelines” document.

Forever says its product stopped a coding agent, mid-session, from installing function-color, a known malicious npm package, and that the order came from that file. Nobody knew how the file got there. Forever’s explanation is that Downloads is the one folder a web page can save a file into without a click, so the web can plant instructions where an agent will later read them. BleepingComputer reported the research on 25 October.

What Forever reproduced

Codex. Forever ran the real attacker file in an isolated VM. Asked anything at all, Codex first added a “project tools” MCP server to its machine-wide config, ~/.codex/config.toml, then ran a child codex exec with --dangerously-bypass-approvals-and-sandbox so the package could be fetched. Because that config is global, every later Codex session on the machine would load the attacker’s server. Forever says Codex ran the malware in more than 90% of its attempts. There is a precondition: Codex only obeys an AGENTS.md in a folder it already trusts, and Forever notes Downloads qualifies once you have worked there.

Claude Code. Forever calls Claude “much harder to fool”. Using its own crafted CLAUDE.md, not the file found in the wild, it got Claude to write an ANTHROPIC_BASE_URL into .claude/settings.json, pointing Claude’s API traffic at a server Forever controls. That leaks the OAuth login token and lets the server answer as the model. The write needs a human to approve it, and Forever says Claude followed through about half the time.

These rates are Forever’s own tests; it has not published attempt counts.

How often agents start in Downloads

Forever says that in its telemetry about half of customers run a coding agent inside Downloads, and roughly a quarter of agent sessions open a real browser. Researcher Gal Weizman told BleepingComputer that Claude Code alone launched more than 1,300 sessions from that folder.

Forever’s position is that “There is nothing here for OpenAI or Anthropic to patch”: the agent is doing what it was built to do, and the problem is a folder the web can write to being treated as trusted. BleepingComputer notes that both vendors already tell users to start their agents in the root of the project they should work on. We found no public statement from either company on the report.

What to do

From Forever’s write-up:

• Never start Codex, Claude Code or any other agent in ~/Downloads. Start it in the project folder.
• Read any AGENTS.md or CLAUDE.md you did not write, in Downloads or in a repo you just cloned, before an agent does.
• Check ~/.codex/config.toml for an unexpected [mcp_servers.*] block or a changed chatgpt_base_url, and a project’s .claude/settings.json for an ANTHROPIC_BASE_URL or proxy you did not set.
• Keep approval prompts and the sandbox on, and distrust any file that asks the agent to turn them off.
• If you find one, assume the token leaked and rotate it. npm has since removed function-color.

For more on files that steer agents, see our MITRE ATT&CK prompt-injection explainer.