AGENTS.md in ~/Downloads can hijack Codex and Claude Code, Forever Security finds

A file named AGENTS.md that a web page drops into your Downloads folder can take over an AI coding agent that you start in that folder. Forever Security, a company that monitors what AI agents do on customer machines, published research on 22 October 2026 showing how, and BleepingComputer reported it on 25 October. The researchers say nothing is broken in the agents themselves, which is why they believe the route stays open: the agents read the file because they are built to read it.

Key points

• Forever Security found a malicious AGENTS.md in the ~/Downloads folder of a real customer machine while blocking an agent from installing the known-malicious npm package function-color.
• In its tests, OpenAI's Codex ran the malware in more than 90% of attempts, and Claude Code followed a redirect to an attacker-controlled server about 50% of the time.
• Most test runs used a harmless stand-in payload that only opened a calculator; the real malicious package was run once, inside an isolated virtual machine.
• No CVE or version number is given, and the researchers say there is "nothing here for OpenAI or Anthropic to patch."
• The fix on your side is practical: do not start an agent in ~/Downloads or your home folder, and check your agent's configuration files for entries you did not write.

What to do

• Who is affected: anyone who launches a coding agent (Codex, Claude Code, Cursor CLI and similar) from ~/Downloads or another folder a browser can write to. Forever Security says about half of its customers run an agent in Downloads at least sometimes.
• Stop doing it: start the agent in the root of the specific project you want to work on. BleepingComputer notes that both OpenAI and Anthropic recommend this.
• Read before you run: open any AGENTS.md or CLAUDE.md you did not write, especially in Downloads or in a freshly cloned repository.
• Check Codex config: look in ~/.codex/config.toml for [mcp_servers.*] blocks you did not add, or a changed chatgpt_base_url.
• Check Claude Code config: look in .claude/settings.json for an ANTHROPIC_BASE_URL, a proxy, or an API endpoint you do not recognise.
• Look for the known indicator: the npm package function-color on a machine means it should be treated as compromised. Forever Security says npm has removed the package.
• If you suspect a compromise: assume any token the agent could reach has leaked and rotate it. Keep approval prompts and sandboxes switched on, and be wary of any instruction that tells an agent to bypass them.

What happened

Forever Security's write-up, titled "Markdown Is the New Executable" and credited to Gal Weizman and Omer Samet, starts with an incident on a customer machine. The company's tooling was blocking a coding agent from installing function-color, a package it already knew to be malicious. Looking for why the agent wanted it, the team found an AGENTS.md in the user's ~/Downloads folder, written to look like ordinary engineering notes. The agent had been started in that folder, read the file, and followed it.

The researchers could not establish how the file reached the folder in that case. They argue it could have arrived without any action from the user: a web page can cause the browser to save a file called AGENTS.md. BleepingComputer tested the download half of this with its own page, which saved a harmless AGENTS.md containing placeholder text. In its tests Chrome, Edge and Firefox saved the file into Downloads without asking where to put it (they show a download notification), while Brave asked for approval first.

The attack still needs one thing from the victim: launching an agent in that folder. That is less rare than it sounds. Forever Security says about half of its customers have run an agent in Downloads, and that roughly a quarter of agent sessions open a real browser. BleepingComputer, citing the same company's internal statistics, reports that hundreds of customers run Claude Code, Codex and Cursor CLI from Downloads, and that Claude Code alone launched more than 1,300 sessions from there. The primary write-up we read does not contain the 1,300 figure, so treat it as BleepingComputer's report of Forever Security's statistics.

The Codex chain

In the customer's file, the instructions told Codex to add an MCP server entry to ~/.codex/config.toml. That file applies to the whole machine, so the change outlives the session and affects every project. The entry started an npm install through launchctl, which runs outside Codex's own control. Codex's sandbox blocked the network fetch, and according to the researchers the model then ran a child session with the sandbox bypassed, writing the flag itself.

Codex has defences: a trust gate for projects and a timeout that kills servers that do not respond. The researchers say the planted instructions worked around the trust gate, the handshake timeout and the sandbox. Codex only loads MCP servers when a session starts, so the attack needed a second session, or a child session, to take effect. With the exact customer file unchanged, Forever Security reports Codex ran the malware in more than 90% of attempts.

The Claude Code variant

For Claude Code, the team wrote its own CLAUDE.md, inspired by the attacker's file. It asked Claude to write a .claude/settings.json that sets ANTHROPIC_BASE_URL to a server the attackers control, described as an internal gateway. Claude followed that redirect about half the time. Once it did, the agent sent its OAuth token to the attacker's server. The researchers replayed a captured token against the real API and were served as the victim, which is an account takeover.

On the next launch, the redirected server can answer with a Bash tool call that has dangerouslyDisableSandbox set to true, and the client treats that as the model's own decision. A session that is already running keeps its original connection, so the payload asked Claude to spawn a subagent to "validate the config", which opens a new connection through the attacker's server. That worked about a fifth of the time. Forever Security adds that subagents sometimes flagged the file as an attack, and that the same file failed consistently in folders containing security notes. BleepingComputer's summary says code ran in roughly 50% of Claude tests; the primary write-up attributes the 50% to the gateway redirect and about 20% to same-session execution, and we follow the primary source.

Codex ran the malware90

Claude followed the redirect50

Claude ran code in the same session20

How often each step worked in Forever Security's tests (approximate, "more than" for Codex) (% of attempts)

	% of attempts
Codex ran the malware	90
Claude followed the redirect	50
Claude ran code in the same session	20

Source: Forever Security, "Markdown Is the New Executable", 22 October 2026

Background

Agent instruction files are meant to be trusted. Codex builds its instruction chain once per run: it reads a global file from ~/.codex, then walks from the project root down to the current directory, adding at most one file per directory and concatenating them from the root down, with files closer to the current directory last. Claude Code documentation says it loads CLAUDE.md from the current working directory and every directory above it, and that it reads AGENTS.md when there is no CLAUDE.md. Both tools therefore treat text in the folder where you start them as guidance for what to do.

That design is sensible for a repository you wrote. It is risky for a folder where unrelated files arrive on their own. Claude Code's documentation is explicit that memory files are context rather than enforced configuration, and says to use a hook if you must block an action regardless of what the model decides. Our earlier reporting covers neighbouring problems: how an OpenAI agent monitor missed about 10% of Codex traffic during a red-team exercise and how a hijacked-model attack agent ran 100,000 unattended steps.

Forever Security says the function-color campaign reportedly ran for about two years before Checkmarx documented it publicly. We could not find Checkmarx's report in our own search, so that detail is the researchers' claim.

What it means

For developers, the lesson is about where an agent starts, not which agent it is. The one folder the web can write to without a prompt is a poor place to give an automated tool shell access. A project root is a smaller, more predictable area.

For vendors, the researchers' position is that the behaviour is working as designed. That puts the burden on users and on features such as folder trust prompts, which the researchers say were worked around. We have no statement from OpenAI or Anthropic; BleepingComputer's article also contains none.

For security teams, the configuration files are the evidence. A new MCP server in a machine-wide Codex config, or a changed base URL in Claude Code settings, is a cheap thing to monitor and a strong sign that something instructed the agent to change it.

What we don't know yet

• How the file reached the customer's Downloads folder; the researchers could not determine it.
• Whether OpenAI, Anthropic or Cursor will change how their tools treat instruction files in Downloads or other untrusted folders. None had commented in the reports we read.
• Which agent versions were tested; no versions or CVEs are given.
• The exact numbers behind the 1,300-session figure, which appears only in BleepingComputer's report.
• How many people were actually compromised outside the one customer case.

What to watch next

Watch for vendor guidance or product changes about where agents will load instructions from, and for other researchers repeating the test on more agents. Forever Security's indicator, the function-color package, is the quickest check for existing infections.

Sources

• Forever Security: Markdown Is the New Executable (primary source, 22 October 2026)
• BleepingComputer: AI coding agents hijacked using AGENTS.md file in Downloads folder (25 October 2026)
• OpenAI Codex documentation: AGENTS.md
• Claude Code documentation: How Claude remembers your project