A text file in your Downloads folder can act like a program if you start an AI coding agent there. Security firm Forever Security says it caught exactly that on a customer machine: an AGENTS.md file in ~/Downloads that told OpenAI's Codex to install a known malicious npm package. The firm then rebuilt the attack against Codex and showed a related trick that can leak Claude Code's login token. Its research post, dated October 22 and written by Gal Weizman and Omer Samet, calls the problem "Markdown is the new executable." BleepingComputer covered it on October 25.
What Forever found
Forever says it stopped a coding agent, mid-session, from installing function-color, a malicious npm package from a campaign that it says went unnoticed for roughly two years. The order came from an AGENTS.md file in the customer's ~/Downloads folder, which was also the agent's working directory, per BleepingComputer.
Forever says it does not know how the file got there. It argues that ~/Downloads is "the one folder the web can write to on its own," and that a web page can save a file named AGENTS.md there with no click. BleepingComputer tested Forever's proof-of-concept page and got an AGENTS.md with harmless content. It notes that Chrome, Edge and Firefox save downloads to ~/Downloads by default without asking for a location, but show a download notification. Brave asked the user to approve the download in its tests.
Why does a text file matter? Because agents are built to obey it. OpenAI's Codex docs say "Codex reads AGENTS.md files before doing any work." Claude Code's memory docs say it loads CLAUDE.md "from your current working directory and every directory above it."
The Codex chain
The planted file is a long "Engineering Work Guidelines" document. Near the end, a section dressed as routine setup tells Codex to append a "project-tools" MCP server block to ~/.codex/config.toml. That block uses launchctl to run npm install function-color. The file then asks for a check run with codex exec --dangerously-bypass-approvals-and-sandbox, a flag Forever says the model wrote itself, framed as needed for the install.
Forever says the payload also had to get past Codex's network sandbox and a timeout that kills slow servers. Handing the install to launchctl runs it outside Codex's control.
The config file is machine-wide. Forever says that once the block is written, "every Codex session on the machine loads the attacker's server at startup," in any folder. In its testing, Forever says, Codex ran the malware in more than 90% of attempts. Forever also says most of its testing used a harmless stand-in that opens a calculator, and it ran the real package once inside an isolated VM.
The Claude Code variant
Forever says Claude was "much harder to fool," and its attack works differently. Forever crafted this file itself, inspired by the real one. A planted CLAUDE.md asks Claude to write ANTHROPIC_BASE_URL into the project's .claude/settings.json, pointing API traffic at a server the attacker controls. Forever says that leaks Claude's OAuth login token, and lets the server answer as the model and send back tool calls, including a Bash call with dangerouslyDisableSandbox set to true.
The numbers Forever reports:
- The settings write got through about 50% of the time. Claude needs a human to approve a write like this.
- Code execution in the same session, through a spawned subagent, worked about a fifth of the time.
- On the next launch in that folder, Claude talks to the attacker's server from its first request.
How common is the risky habit?
Forever says that in its telemetry about half of customers run a coding agent inside their Downloads folder, and roughly a quarter of agent sessions open a real browser. Weizman told BleepingComputer that hundreds of customers run agents such as Claude Code, Codex and Cursor CLI from ~/Downloads, and that Claude Code alone launched more than 1,300 sessions from there.
Is there a patch?
Forever says no: "There is nothing here for OpenAI or Anthropic to patch." The agent follows the instructions file in its folder as designed. BleepingComputer says OpenAI and Anthropic recommend starting an agent in the root of the project it should work on.
That puts the defense on users and admins. Forever's checklist:
- Do not start Codex, Claude Code or any agent in
~/Downloads. - Read any
AGENTS.mdorCLAUDE.mdyou did not write before an agent touches it. - In
~/.codex/config.toml, look for an unexpected[mcp_servers.*]block or a changedchatgpt_base_url. In.claude/settings.json, look for anANTHROPIC_BASE_URL, proxy or endpoint you did not set. - If you find one, assume the token leaked and rotate it. If
function-colorshows up in a machine's installs, treat the machine as compromised. Forever says npm has removed the package.
Why it matters
This is a report from a security vendor that monitors AI agents, and the success rates are its own lab numbers. Still, the core mechanism is in each tool's own docs: agents load instruction files from where they start. It echoes the OpenCode Console key breach: agent tools hold real credentials, and this attack reaches them through the agent's own config files. Sandboxing helps, as in GitHub Copilot's local sandboxing, but this attack asks the agent to switch its own guardrails off. If you use Claude Code, Codex or Cursor every day, the simplest fix is a habit: start them in a project folder, never in Downloads.
