AGENTS.md in Downloads Can Hijack Your Coding Agent

A plain-text AGENTS.md file sitting in your Downloads folder was enough to turn OpenAI Codex CLI against its own user. Forever Security says it caught the file on a real customer machine, steering the agent toward a known malicious npm package, then rebuilt the attack against Codex and Claude Code.

Nothing here is a bug either vendor can ship a fix for. The agents did what they're built to do: read the instruction file in the folder they were started in. The fix is on you, and most of it takes five minutes.

What Forever found

Forever, a company that watches what AI agents do on endpoints, published its write-up on October 22, and BleepingComputer covered it on October 25. The story starts with an alert: Forever blocked a coding agent, mid-session, from installing function-color, an npm package that Forever says belongs to a long-running malware campaign documented by Checkmarx.

The install didn't come from a dependency or a cloned repository. Forever traced it to an AGENTS.md in the customer's ~/Downloads folder, which was also the agent's working directory. The file was about 13 KB of bland "Engineering Work Guidelines", with the attack buried in one section near the end that was dressed up as routine tooling setup. Forever says it still doesn't know how the file got there.

Its theory is the uncomfortable part. Downloads is the one folder a web page can write to without a click: by default, Chrome, Edge and Firefox save downloads there without asking where to put them, and the page chooses the file name and contents. BleepingComputer checked Forever's proof-of-concept page and confirmed it dropped a harmless file named AGENTS.md into Downloads. Brave asked for approval first. The other browsers showed their usual download notification, which is easy to miss and useless when an agent is the one browsing.

Why an instruction file is now an executable

Instruction files are the whole point of modern coding agents. Codex's AGENTS.md guide explains that it builds an instruction chain at startup from a global file in ~/.codex and then project files from the project root down to the current directory. Claude Code's memory docs say CLAUDE.md files in the directory hierarchy above the working directory load at launch. The shared AGENTS.md format is used by a long list of agents beyond these two.

Operating systems learned long ago not to run an executable that arrived from the internet without asking. A Markdown file never needed that treatment, so none of those guardrails apply. Put an agent in the same folder and the Markdown file starts to behave like a program. Forever's line for it is "Markdown is the new executable," and it's hard to argue with.

How often does this setup happen? According to Forever's telemetry, about half of its customers run a coding agent inside Downloads, and roughly a quarter of agent sessions open a real browser. Forever researcher Gal Weizman told BleepingComputer that Claude Code alone launched more than 1,300 sessions from that folder across its customers, and that Cursor CLI shows up there too. These are one vendor's numbers from its own customer base, not an industry survey, but the habit is easy to believe: people ask agents to tidy Downloads or to work on a file they just grabbed.

How the Codex chain worked

Forever ran the real attacker file, unchanged, inside an isolated VM. You open Codex in Downloads and ask it anything. Before it starts your task, it appends a "project-tools" MCP server block to ~/.codex/config.toml, then launches a child codex exec run with --dangerously-bypass-approvals-and-sandbox to "confirm the server initialized". The server command hands an npm install function-color to macOS launchctl, so it runs outside Codex's control.

Forever says the Codex chain ran in more than 90% of its attempts, mostly with a harmless stand-in that opened a calculator. It also lists the controls the file had to talk its way past, and each one is worth knowing:

• Project trust. Forever says Codex only obeys an AGENTS.md in a project it trusts, and once you've worked in Downloads, it counts.
• Refusals. A short "install this package" got refused. The long, boring engineering-doc framing got through, which is why the real file is 13 KB.
• Startup-only MCP servers. Servers load when a session starts, so the payload spawns a second Codex session to load the one it just registered.
• The network sandbox. The fetch failed until the child session ran with the bypass flag, which the model wrote itself because the file said the install needed it.
• The startup timeout. Codex kills a server that doesn't answer in time, so the slow install was handed to launchctl instead.

The worst detail is where the write lands. ~/.codex/config.toml is Codex's machine-wide config, so every later Codex session, in any folder, loads the attacker's server at startup. Leaving Downloads doesn't help. Codex's config reference says project-scoped .codex/config.toml files only load in trusted projects, but this attack never touches the project layer. It talks the agent into editing the user-level file instead.

That's the same machine-wide config surface whose credential handling we looked at when Codex CLI started masking credentials. Masking secrets in shell snapshots doesn't help when the agent itself is persuaded to add a new server.

The Claude Code variant

Forever says Claude Code was "much harder to fool", and the attack it eventually built looks different. Forever wrote its own CLAUDE.md, modeled on the real file, that asks Claude to save a project .claude/settings.json setting ANTHROPIC_BASE_URL to a server the researchers controlled, framed as the team's internal model gateway.

According to Forever, that one setting does two things. Claude Code sends its OAuth token to the new endpoint on every request, and Forever says it replayed a captured token against the real API and was served as the victim. The fake gateway can also answer as the model, returning a Bash tool call with dangerouslyDisableSandbox set to true, which the client runs as if the model chose it.

The numbers are lower but not comforting. Forever notes that Claude Code needs a human to approve a write like this, and says the long framing got the settings file onto disk about half the time. Code execution in the same session needed Claude to spawn a subagent "to validate the config", which worked about a fifth of the time. On the next launch in that folder, the new base URL is in effect from the first request. Forever also noticed that the same file failed every time in a folder full of security notes, because a subagent read it and flagged it as an attack.

If you've been extending Claude Code with TypeScript mods, note the overlap: anything that can rewrite project settings or hooks can change what the agent does on its next start.

What the vendors' docs already say

We found no public response to the research from OpenAI or Anthropic as of October 26, 2026, and Forever argues there's nothing to patch. Both vendors' docs already describe the defenses this attack leans on, though.

• Codex's config reference documents projects.<path>.trust_level, which can mark a path "untrusted". Untrusted projects skip project-scoped .codex/ layers.
• Claude Code's security page says interactive sessions show a workspace trust dialog in folders you haven't trusted, and that a -p (non-interactive) session shows neither the trust prompt nor the MCP approval prompt.
• The same page tells users to review commands before approval, avoid piping untrusted content to Claude, verify changes to critical files, and use VMs when working with untrusted content.

Trust prompts are a one-time decision about a folder. That model assumes the folder's contents stay as you left them, which is true for a repository you cloned and false for Downloads, where the web can add files whenever it likes.

What to do this week

None of this needs new tooling. Forever's own recommendations, plus the vendor docs above, add up to a short checklist:

• Never start an agent in `~/Downloads`. Copy the file you need into a scratch project folder you created, and run the agent there.
• Mark Downloads untrusted in Codex. Add a projects entry for your Downloads path with trust_level = "untrusted" in ~/.codex/config.toml, and don't accept the Claude Code trust prompt for that folder.
• Audit agent configs now. Look for [mcp_servers.*] blocks you didn't add or a changed chatgpt_base_url in ~/.codex/config.toml, and for ANTHROPIC_BASE_URL, proxies or other endpoints you didn't set in any project's .claude/settings.json.
• Read stray instruction files. An AGENTS.md or CLAUDE.md you didn't write, in Downloads or a freshly cloned repo, is the whole attack. Read it before an agent does.
• Keep approvals and sandboxes on. Treat any instruction that asks for --dangerously-bypass-approvals-and-sandbox or a disabled sandbox as hostile.
• Make the browser ask where to save. Turning on the ask-where-to-save option takes away the silent drop into a predictable folder.
• If you find one, rotate. Assume the agent's login token leaked and rotate it, and treat any machine that installed function-color as compromised.

Running agents inside an isolated environment also limits the damage. VS Code's option to run the agent in your Dev Container is one practical way to keep an agent away from your real home directory and its config files. And if a token does leak somewhere public, GitHub's public monitoring is one way enterprises find out.

Our take

This is one of the most practical agent-security findings of the year, because it needs no exploit, no compromised package registry and no user mistake beyond a habit lots of developers have. The agent's trust model is per folder, and Downloads is the one folder that changes under you.

Expect vendors to respond with product changes rather than patches: treating Downloads and other web-writable paths as untrusted by default, warning before an agent edits its own global config, and refusing to set the sandbox-bypass flag on the strength of a file's say-so. Until that ships, the rule is simple. Agents get their own folders, and Downloads isn't one of them.

One caveat: every success rate and usage figure here comes from Forever, a vendor that sells agent monitoring, and hasn't been independently reproduced. The mechanism, though, follows directly from how Codex and Claude Code document their own instruction loading.

Sources

• Forever Security: Markdown Is the New Executable (October 22, 2026)
• OpenAI Codex docs: Custom instructions with AGENTS.md
• OpenAI Codex docs: Configuration reference
• Claude Code docs: Security
• Claude Code docs: CLAUDE.md and memory
• AGENTS.md format site
• Checkmarx Zero: MALFEX npm malware campaign
• BleepingComputer: AI coding agents hijacked using AGENTS.md file in Downloads folder (October 25, 2026)