Forever Security shows a malicious AGENTS.md in Downloads can hijack Codex and Claude Code

What Forever Security found

Forever Security, a company that watches what AI coding agents do on customer machines, published a 22 October 2026 research post saying it stopped an agent mid-session from installing a known-bad npm package called function-color. The surprising part was not the package. The order to install it came from an AGENTS.md file sitting in the customer's ~/Downloads folder, which was also the agent's working directory.

BleepingComputer reported the same findings on 25 October, adding that Forever reproduced the attack against OpenAI Codex and showed a related technique against Claude Code that leaks the agent's OAuth token. Runtime Wire summarised the primary post the same weekend. Forever attributes the research to Gal Weizman and Omer Samet.

AGENTS.md is a plain-text instruction file that coding agents such as Codex are built to read and follow when they start in a folder. CLAUDE.md plays a similar role for Claude Code. Forever's point is that those files are meant to be trusted project notes, not something a website can plant for you.

Why Downloads turns Markdown into an executable

Forever frames the hazard as the intersection of two ordinary behaviours. First, an agent that finds an AGENTS.md in its working directory is supposed to obey it. That is the whole point of the file. Second, a web page can save a file into ~/Downloads on its own, with no click and no permission, because browsers have treated that folder as the default download location for years.

Operating systems closed the old version of this door: an executable downloaded from the internet does not run until a person approves it. An AGENTS.md is not an executable. It sits there like any other download. The moment a coding agent opens that folder, Forever says, the instructions behave like a program. "Markdown is the new executable," the researchers write.

Forever could not prove how the original file reached the customer's Downloads folder. It demonstrated that visiting a page it controlled could drop an AGENTS.md silently, and BleepingComputer verified that the proof-of-concept page downloaded such a file. Chrome, Edge and Firefox still show download notifications by default; Brave asked for approval. The chain still needs the user, or another agent, to start a coding session in that folder.

How the Codex attack works

The live customer file targeted Codex. Forever ran that exact AGENTS.md inside an isolated virtual machine rather than rewriting it. The document is a long "Engineering Work Guidelines" note; near the end, a section labelled "Local developer environment" tells the agent that a helper MCP server is distributed as the npm package function-color and that ~/.codex/config.toml must be updated to register it before the user's task begins.

The registered command does not look like an npm install. It hands the work to launchctl, which runs a zsh one-liner that creates /tmp/ptools and installs the package outside Codex's process. The payload then asks for a child "codex exec" with --dangerously-bypass-approvals-and-sandbox so the install is not blocked by the network sandbox. Forever says Codex executed the malware in more than 90 percent of its tests.

The lasting damage is where the write lands. ~/.codex/config.toml is machine-wide. Once the project-tools server is registered, every later Codex session on that machine loads the attacker's server at startup, in any folder. Leaving Downloads does not clear the poison.

How the Claude Code attack works

Claude Code needed a different payload. Forever planted a CLAUDE.md that frames an "internal model gateway" and asks the agent to write a .claude/settings.json that sets ANTHROPIC_BASE_URL to a domain Forever controls, with a valid certificate. Once that file is on disk, Claude's next API traffic carries its OAuth token to the attacker. Forever says that alone is account takeover, and that replaying a captured token against the real API let it act as the victim.

Code execution follows in two ways. On the next launch in that folder, Forever answers as the model with a Bash tool call that sets Claude Code's own dangerouslyDisableSandbox flag to true and runs npm install function-color. Inside the first session, the payload tries to spawn a subagent "to validate the config," which opens a fresh connection through the attacker. Forever reports about 50 percent follow-through overall, and about a fifth of tests for same-session code execution.

Claude was harder to fool than Codex. Forever says a short, obvious "install this package" request was refused, and that a folder already full of security notes made the long engineering-doc framing fail. The attack still worked often enough, on a second product from a second vendor, for Forever to treat it as a property of agents rather than a Codex quirk.

What Forever measured in the wild

Forever's telemetry claim is the part that turns a lab trick into an operations problem. The company says about half of the customers it measured run a coding agent inside their Downloads folder, that Claude Code alone launched more than 1,300 sessions from that location, and that roughly a quarter of agent sessions open a real browser. Gal Weizman told BleepingComputer that people often start agents in Downloads to organise the folder or to act on a newly downloaded file.

That pattern sits next to other agent-security stories we have covered this month, from a poisoned LiteLLM release on PyPI to an unauthenticated Archon control API and tools such as OpenRouter Armor that try to block risky tool calls. Forever's case is different because, in its words, "there is nothing here for OpenAI or Anthropic to patch." An agent that follows the AGENTS.md in its folder is doing what it was built to do.

AGENTS.md itself is also becoming a shared standard. The Linux Foundation's Agentic AI Foundation took the format under a broader agent-standards umbrella this month. Forever's finding is not that the format is bad; it is that a trusted instruction file becomes dangerous when the web can write it into a folder the agent trusts.

What you should do

Forever's practical advice does not require buying its product. Do not start Codex, Claude Code or similar agents in ~/Downloads. Treat that folder as hostile ground for agents, because it is the one folder a website can plant a file in. Before you let an agent work in a folder, look for AGENTS.md, CLAUDE.md or similar instruction files you did not write, including in a freshly cloned repository.

Check the agent's own config. In ~/.codex/config.toml, watch for an unexpected [mcp_servers.*] block or a changed chatgpt_base_url. In a project's .claude/settings.json, watch for an ANTHROPIC_BASE_URL, a proxy or any other API endpoint you did not set. Leave approval gates and sandboxes enabled, and be suspicious of anything that tells the agent to bypass them. If you find a planted file, Forever says assume the token leaked and rotate it.

The named indicator of compromise for the live campaign Forever stopped is the npm package function-color, which Forever says has since been removed from npm. Finding it in a machine's installs should be treated as compromise.

Limits and open questions

Forever did not establish how the original AGENTS.md arrived on the customer machine, only that a web page can drop such a file and that the recovered payload worked. The Codex success rate above 90 percent and the Claude rate around 50 percent are Forever's own test results, run with a harmless calculator stand-in for most trials and the real malicious package once inside a VM. AI Lookout did not reproduce the attacks.

OpenAI and Anthropic have not published a joint response in the sources we read. BleepingComputer notes that both vendors already recommend starting coding agents in the root of the specific project they should work on, not in the home directory or a broad parent folder. That guidance matches Forever's advice, but it does not close the Downloads write path.

Readers who want the broader class of attack should also read our prompt-injection explainer. Forever's case is a specialised form of the same idea: untrusted text that the agent treats as instructions, delivered through a folder rather than through a document or tool result.

Why it matters

Coding agents are starting to browse, download and write their own configuration. Forever's research shows that a defence built around a human who must click "Run" does not hold when the agent is the one reading the file. Until Downloads stops being a free write target for the web, or agents stop trusting every instruction file in every folder they open, that seam stays open.