A Markdown File in Your Downloads Folder Can Hijack Your Coding Agent
Researchers showed that a planted AGENTS.md or CLAUDE.md can turn Codex and Claude Code into malware installers. There is no patch, because the agents are doing what they were built to do.
Security firm Forever Security found a malicious AGENTS.md sitting in a customer's Downloads folder, and a coding agent had already tried to install a malicious npm package called function-color because of it. BleepingComputer covered the findings on October 25.
The attack needs no exploit. Agents read instruction files from their working directory and follow them. Put a hostile one in a folder where people launch agents, and you are done.
How it works
A web page can silently drop a file into Downloads. Chrome, Edge, and Firefox save there by default, and Brave asks first. Then a developer opens an agent in that folder to sort files or act on a new download, and the agent loads the planted instructions.
Forever reports that about half of its customers run a coding agent inside Downloads. People do it because the folder is where the mess is.
What the researchers got
| Target | What the file made the agent do | Reported success |
|---|---|---|
| OpenAI Codex | Add an MCP server entry to the global ~/.codex/config.toml that runs an npm install of function-color at startup | Over 90% |
| Claude Code | Write .claude/settings.json with an attacker-controlled ANTHROPIC_BASE_URL, leaking the OAuth token | About 50% |
| Claude Code, second stage | Return a Bash tool call with the sandbox disabled on the next launch | Same-session run about 1 in 5 |
The Codex run is the worst part. The model wrote the sandbox-bypass flag into the command itself, so the sandbox never got a vote.
Forever's position is that there is nothing for OpenAI or Anthropic to patch. The agents followed instruction files as designed. I agree, and that is why this will keep happening.
What to do this week
- Stop launching agents from Downloads, your home folder, or any directory you did not create. Start them inside a specific project. This one change removes the whole attack.
- Audit the two config files that got written. Look in
~/.codex/config.tomlfor[mcp_servers.*]blocks you did not add or a changed base URL. Look in.claude/settings.jsonfor an unexpectedANTHROPIC_BASE_URLor proxy. - Read any AGENTS.md or CLAUDE.md you did not write. Treat it like a shell script from a stranger, because that is what it is.
- Keep approvals and sandboxes on. Do not run with approvals disabled as a daily habit. If you suspect a compromise, rotate your tokens.
- Search for
function-colorin your lockfiles. npm has removed the package, but a past install is the indicator of compromise.
The bigger point
We spent two years telling teams to put more context in markdown files so agents behave. Those files are now executable authority, and nobody reviews them like code.
If your team keeps specs and agent rules in the repo, require review on every change to them, the same as any CI config.
Found this helpful? Share it with others!