A Planted AGENTS.md in ~/Downloads Can Steer Codex and Claude Code

Forever Security says it found a malicious AGENTS.md in a customer’s ~/Downloads folder, disguised as ordinary engineering notes, and that its tooling stopped a coding agent from acting on it. The researchers then rebuilt the attack in the lab. Against OpenAI Codex it worked in more than 90% of attempts, per Forever. A variant aimed at Claude Code worked about half the time at redirecting the agent’s traffic, and about one test in five reached code execution (Help Net).

What Forever Security found

Forever’s account reached us through BleepingComputer (25 October) and Help Net Security (26 October); we could not open Forever’s own report. On the customer machine, a coding agent tried to install the npm package function-color. Help Net relays Forever’s claim that the package was part of an npm campaign that went unnoticed for about two years, and that npm has since removed it. The attempt traced to an AGENTS.md file sitting in the agent’s working directory, ~/Downloads. Forever’s software blocked the install.

How the file got there is unknown. The researchers say a malicious web page can save a file to the Downloads folder without a prompt, and BleepingComputer reports that a test page did drop a harmless AGENTS.md that way. Brave prompts for approval, per the same report. BleepingComputer describes ~/Downloads as the one folder the web can write to on its own.

Two different attacks

Codex. Per Help Net, Codex follows AGENTS.md in folders it trusts, and Downloads qualifies once the user has worked there. The planted file was 13 KB and written in a flat engineering-guidelines tone. Opened in that folder with any task, Codex first changed its own settings, then installed the package. Because those settings apply to the whole machine, later sessions in unrelated projects would also run the attacker’s command. Most testing used a harmless payload; the real package ran once, inside an isolated virtual machine.

Claude Code. The researchers say Claude was much harder to fool, and that the file that worked was their own CLAUDE.md, modelled on the attacker’s file. It presented a settings change as an internal company gateway, which sent API traffic to a server the researchers controlled. Claude Code normally asks for approval for that kind of change. Every request carries the user’s login token, so replaying a captured token let the researchers take over an account without running any code. The attacker’s server could also pose as the model and tell the agent to run commands with its sandbox turned off.

The sources disagree on how often that last step worked. Help Net quotes the researchers on “about 50% of the time” for Claude following through on the settings change and reports code ran in the same session in about a fifth of tests. BleepingComputer says the impersonating server executed code in “roughly 50% of tests.” We cannot reconcile the two without Forever’s report.

How much weight to give it

These are vendor lab results with a commercial interest, and the in-the-wild evidence is one customer machine where the payload was stopped before it ran. Our assessment: the Codex figure rests on a benign stand-in payload, so it shows the agent follows the file, not that real malware would succeed 90% of the time. The Claude Code result came from a purpose-written file, not the file found in the wild.

The finding does fit a documented pattern. A CSA research note dated 27 October lists earlier cases where agent instruction and settings files were abused, including the Rules File Backdoor (Pillar Security, March 2025) and the Miasma worm (StepSecurity, June 2026). Forever’s own telemetry, per Help Net, shows about half its customers run a coding agent in Downloads and about a quarter of agent sessions open a browser. BleepingComputer adds that Claude Code alone launched more than 1,300 sessions from that location. These figures are Forever’s and have not been replicated.

Defensive guidance

None of this needs a patch to reduce. The first four items follow the researchers’ advice as reported by Help Net; the last two are our guidance.

• Never use ~/Downloads, a home directory or another broad folder as an agent’s working directory. Run agents from the specific project directory.
• Search for unexpected AGENTS.md, CLAUDE.md and agent settings files, and check settings for endpoint overrides (for example ANTHROPIC_BASE_URL, the variable redirected in the Claude test) that you did not add.
• Keep approval prompts and sandboxing enabled, and treat any instruction to bypass them as a red flag.
• If a planted file turns up, rotate the tokens and API keys it could have exposed. Treat any machine where function-color was installed as compromised.
• Our guidance: express prohibitions as permission rules, sandbox profiles and egress allow-lists, not as prose in an instruction file. Anthropic’s documentation, as quoted by CSA, describes CLAUDE.md as “context, not enforced configuration.”
• Our guidance: add coding agents to supply-chain risk models and tabletop exercises.

References

• BleepingComputer: AI coding agents hijacked using AGENTS.md file in Downloads folder
• Help Net Security: AI coding agents fall for malicious instructions planted in the Downloads folder
• Cloud Security Alliance: Markdown Is the New Executable: Instruction-File Poisoning of AI Coding Agents
• Dark Reading: In-the-Wild Attack Abuses AI Agents’ Trust in Markdown (found in search; we could not open it)