AI coding agents hijacked with an AGENTS.md in Downloads

Researchers at Forever Security, a company that monitors the risks introduced by AI agents, found a malicious AGENTS.md file in the ~/Downloads folder of a customer’s computer. The file pushed a coding agent to try installing the malicious npm package function-color; their software blocked the installation before it ran. Starting from that file, Gal Weizman and Omer Samet reproduced the attack against OpenAI Codex and showed a different technique against Claude Code that leads to theft of the access token. The story was reported by BleepingComputer, Help Net Security, CSO Online, The Hacker News and Dark Reading.

There is no CVE and, according to the researchers, nothing to patch either: an agent that follows the instruction file in its folder is doing exactly what it was built to do. Defence is therefore up to the people who use and manage agents.

Why AGENTS.md and the Downloads folder

AGENTS.md (for Codex) and CLAUDE.md (for Claude Code) are Markdown text files with project instructions: tools to use, how to run tests, coding conventions. Agents load them automatically from their working directory. They are not executables, so the operating system checks on programs downloaded from the internet do not apply; but the agent runs commands, installs packages and changes settings with whatever permissions it has. “Markdown is the new executable,” the researchers write.

Downloads, Forever notes, is the one folder a web page can write to on its own. With default settings, Chrome, Edge and Firefox save files there without asking where, though they show a download notification; in BleepingComputer’s tests Brave asked for confirmation instead. BleepingComputer checked the researchers’ demo page: it downloaded an AGENTS.md with harmless content. How the file reached the customer’s computer has not been established.

The agent then has to be started in Downloads itself, and according to Forever that happens often: to tidy up the folder or work on a freshly downloaded file. The figures reported differ in form: Weizman told BleepingComputer that hundreds of customers run agents (Claude Code, Codex, Cursor CLI) from Downloads, with more than 1,300 Claude Code sessions started there; Help Net Security reports about half of customers, and adds that about a quarter of agent sessions open a browser. An agent browsing on its own can therefore download the very file that then attacks it.

The chain against Codex

• Codex follows an AGENTS.md only in a trusted folder, and Downloads becomes trusted once the user has worked there.
• The file found is about 13 KB and is disguised as engineering guidelines: according to the researchers its length and mundane tone help it through, while a short request to install a package gets refused.
• Given any user task, Codex first modified its machine-wide MCP server configuration, then launched another session with approvals and sandbox disabled and installed the package.
• Success in more than 90% of attempts, almost always with a harmless stand-in that opens the calculator; the real package was run only once, inside an isolated virtual machine.
• Because the malicious server stays in the global configuration, every later Codex session loads it, in any project.

According to Forever, function-color belonged to a malicious npm campaign that went unnoticed for about two years; npm has removed it.

The Claude Code variant

For Claude Code the researchers wrote their own CLAUDE.md, inspired by the one they found. Claude proved “much harder to fool”, and the attack that worked is different:

• the file asks the agent to save a settings change, presented as the company’s internal gateway, that sends API requests to an attacker-controlled server; Claude Code normally asks for approval and often refuses;
• the change was saved in about 50% of tests;
• every request carries the user’s OAuth token: by replaying it against Anthropic’s service the researchers took over the victim’s account without running any code;
• on the next start in that folder, the server can pose as the model and order commands with the sandbox turned off.

The sources differ on code execution: according to BleepingComputer it succeeded in roughly half of the tests; according to Help Net Security, within the same session, through a helper agent that immediately connects via the attacker’s server, in about a fifth.

In MITRE ATT&CK terms, the theft and reuse of the token map to T1528 (Steal Application Access Token) and T1550.001 (Application Access Token); in the MITRE ATLAS matrix the entry point is an indirect prompt injection (AML.T0051.001).

How worried to be

Sakshi Grover of IDC, speaking to CSO Online, calls it a credible early warning rather than proof of widespread exploitation: the success rates have not been independently validated. The broader risk, she adds, is not Downloads as such but the pattern of agents ingesting untrusted content while holding live credentials: the same file can arrive through cloned repositories, shared folders or packages.

For European and Italian companies the issue is developer workstations, which hold tokens, keys and access to source code. For NIS2 entities, agents fall under the Article 21 measures on secure development, supply chain and access control.

What to do now

1. Never start an agent in Downloads or in your home folder: always in the project root, as OpenAI and Anthropic recommend.
2. Read every AGENTS.md or CLAUDE.md you did not write, including in freshly cloned repositories, and treat them as source code, with an owner who approves changes.
3. Check agent configurations (for example ~/.codex/config.toml and the user and project .claude/settings.json files) for MCP servers or addresses you did not add.
4. Keep approvals and sandbox on and forbid options such as --dangerously-bypass-approvals-and-sandbox; distrust any instruction asking to get around them.
5. If you find a planted file, treat the token as compromised and revoke it. A machine where function-color was installed should be treated as compromised.
6. Route installations through an internal package registry or a scanning proxy, restrict agents’ network access and, where production credentials are present, use isolated development environments and short-lived tokens.

How ARXDOME helps

The ARX Sentry agent collects the software and process inventory of workstations and checks file integrity in the folders you choose: agent configuration folders can be included to spot unexpected changes. ARX Shield shows open vulnerabilities per package and lets you isolate a suspicious machine from the network while tokens are revoked.

Last updated: 26 October 2026