Security Alert: A Downloads-Folder AGENTS.md File Hijacks Codex and Claude Code — No Click Required

🌏 中文版

What happened

Forever Security researchers Gal Weizman and Omer Samet published a report on October 22, 2026, describing how they caught a coding agent on a real customer's machine in the act of trying to install a known-malicious npm package, function-color. Tracing the instruction back, they found it hadn't come from any code or dependency — it came from an AGENTS.md file sitting in the customer's ~/Downloads folder, a file format that many coding agents (OpenAI's Codex, Anthropic's Claude Code) automatically read on startup and treat as working instructions. Nobody knows how the file got there. The researchers rebuilt the entire attack chain and confirmed it: if a browser silently saves a malicious file into Downloads, and the user happens to launch their agent from that folder, the attack can run to completion with the user noticing nothing — over 90% success at getting Codex to install the malicious package, and roughly 50% success at escalating to account takeover on Claude Code. BleepingComputer, Help Net Security, Dark Reading, and CSOonline have all independently covered and corroborated the research.

Key facts

Attack surface analysis

The attack chain has two layers: getting the file onto the machine, and getting the agent to actually act on it. The first layer exploits a thirty-year-old browser behavior nobody treated as a risk: Chrome, Edge, and Firefox all save web-triggered downloads straight into ~/Downloads by default, with no click to approve and no prompt to choose a save location. That was never dangerous in a world where "downloaded file" meant "possibly executable," because operating systems long ago stopped unapproved downloads from running themselves. The problem is that coding agents treat plain-text files like AGENTS.md and CLAUDE.md as trusted project configuration rather than as untrusted input the user happened to download. So a web page can, without the user noticing anything, drop a long document disguised as "engineering guidelines" into Downloads. Later, when the user launches their agent from that same folder — Forever's telemetry shows roughly half its customers do exactly this, often to have the agent tidy up a recent download — the agent reads the planted file and treats it as its own marching orders.

The second layer is getting the model to actually follow through. Against Codex, the attackers wrapped the malicious instruction inside a section that reads like ordinary "local developer environment setup," asking the agent to register a fake "project tools" MCP server in ~/.codex/config.toml — the machine-wide config, not something scoped to one folder — which in reality launches npm install function-color via launchctl. The researchers found this text worked around five independent controls, each a finding in its own right: a trust gate (once you've worked in Downloads, Codex treats it as a trusted project), review (a blunt "install this" request gets refused, but the same payload wrapped in a long engineering document gets through), a startup-only loading restriction (worked around with a one-off child session), the network sandbox (bypassed by having the model write its own --dangerously-bypass-approvals-and-sandbox flag), and a handshake timeout (handed off to launchctl, running outside Codex's control). Because the write lands in the machine-wide config, the damage isn't scoped to Downloads — every later Codex session, in any folder, loads the attacker's server.

Against Claude Code, the researchers found direct package-install instructions met much stronger resistance, so they pivoted to a forged CLAUDE.md disguised as "internal API gateway setup," getting the agent to write .claude/settings.json with an ANTHROPIC_BASE_URL pointing at a server the attackers control. That single rewrite accomplishes two things at once: every subsequent API call now ships Claude's OAuth token to the attacker's server (account takeover on its own), and the attacker's server can impersonate the model and feed back tool calls — including a Bash call carrying dangerouslyDisableSandbox: true — that Claude's own client runs as if the model itself had decided to. This maps to LLM01: Prompt Injection on the OWASP LLM Top 10 (the payload arrives via an indirect, local-file channel) combined with LLM06: Excessive Agency (the agent can rewrite the very configuration that defines its own trust boundary, and then trusts what it just wrote, far beyond what "reading a document" should require). Forever's position, which OpenAI and Anthropic don't dispute, is that this isn't a patchable bug — an agent following the instructions file in its working directory is doing exactly what it's designed to do. The gap is that a web page can silently change the contents of a folder the user trusts, and that seam falls outside anyone's existing threat model.

How to defend against it

The practical move right now is to treat this as a known, unpatchable attack surface to route around through habit change, not to wait for a vendor fix. Longer term, it's worth adding the kind of behavioral monitoring that traditional endpoint security doesn't cover: an agent rewriting its own configuration or switching its own network endpoint.

Immediate actions

• Stop using ~/Downloads as the working directory for Codex, Claude Code, or any coding agent — launch them only from an explicit project folder
• Check ~/.codex/config.toml for unfamiliar [mcp_servers.*] entries, and check every project's .claude/settings.json for an ANTHROPIC_BASE_URL, proxy, or endpoint you didn't set
• Look for an AGENTS.md or CLAUDE.md you didn't write, whether in Downloads or in a freshly cloned repo, and read it before letting an agent near it
• Check for the malicious package Forever identified, function-color (now removed from npm); if it's installed anywhere, assume the whole machine is compromised and rotate every related credential and token immediately

Longer-term architecture

• Keep approval gates and sandboxes enabled, and treat any instruction that asks an agent to temporarily disable them as highly suspicious — that flag is almost always something the attacker wrote to talk the model into it
• Add integrity monitoring at the agent runtime layer that alerts in real time on non-user writes to files like ~/.codex/config.toml or .claude/settings.json; watchlist company Netzilo is positioned exactly for this kind of agent runtime governance and one-click kill switch, suited to catching an agent rewriting its own configuration
• When agent traffic can be redirected to an unexpected endpoint (as with the ANTHROPIC_BASE_URL rewrite here), watchlist company WitnessAI focuses on visibility and guardrails for enterprise agent traffic, catching the moment a base URL gets redirected rather than waiting until the stolen token is actually used

Scope of impact

Forever's customer telemetry shows roughly half of customers run an agent with ~/Downloads as the working directory, and roughly a quarter of agent sessions open a real browser — this is not a niche edge case. For Claude Code alone, the company's customer base logged more than 1,300 sessions launched from a Downloads folder. The only confirmed real-world attack so far is the one caught on that customer's machine, stopped before the malicious install could run, with no actual damage done; how the AGENTS.md file got onto that machine's Downloads folder in the first place remains unknown, and there's no evidence yet of whether this is an isolated incident or has already been replicated at scale. Because OpenAI and Anthropic both regard this as inherent agent behavior — trusting the working directory is the design — rather than something to patch, this attack surface stays open until users and organizations change how they launch their agents.

If anyone on your team has a habit of letting Claude Code or Codex "tidy up Downloads" for them, this report describes the attack surface you're exposed to right now.

Today's takeaway

Most prompt-injection scenarios assume the attack happens mid-task — the agent reads a malicious web page or PR while it's already working, and gets steered into doing something bad. What's different here is that the attack happens before any task begins, at the step where the agent loads its own working-directory configuration, and the goal isn't to get the agent to do one bad thing right now — it's to get the agent to quietly rewrite its own trust boundary (a global config file, an API endpoint), turning a single read into a persistent, machine-level, cross-session compromise. The reminder: an agent's "load my config" step is its own attack surface, not meaningfully safer than the "call a tool" step everyone already watches.

References

• Forever Security — Markdown Is the New Executable: Attackers Are Dropping Agent Instructions Into Your Downloads Folder From the Web
• BleepingComputer — AI coding agents hijacked using AGENTS.md file in Downloads folder
• Dark Reading — In-the-Wild Attack Abuses AI Agents' Trust in Markdown
• Help Net Security — AI coding agents fall for malicious instructions planted in the Downloads folder
• OWASP Top 10 for LLM Applications