> ## Content Index
> Fetch the complete content index at: https://www.skimwire.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# A planted file in your Downloads folder can turn Codex and Claude Code against you
- URL: https://www.skimwire.com/agents-md-downloads-folder-attack-codex-claude-code/
- Published: 2026-10-24T16:03:44.000Z
- Updated: 2026-10-24T16:03:44.000Z
- Description: Forever caught a malicious AGENTS.md in a customer's Downloads folder that made a coding agent install malware. What to check and how to stay safe.
- Author: Jeremy Moon
- Tags: Security, AI

## The skim

- Security firm Forever says it caught a real attack that used a plain-text `AGENTS.md` file in a customer's Downloads folder to make an AI coding agent install malware.
- In its tests, the real file got OpenAI's Codex to run the malicious package in more than 90% of attempts. A file Forever wrote for Claude Code worked about half the time and exposed its login token.
- The fix is on you: don't start coding agents in Downloads, read instruction files you didn't write, and keep sandboxes and approvals on.

## What happened

Coding agents like Codex and Claude Code read instruction files, `AGENTS.md` or `CLAUDE.md`, from the folder they're started in, and follow them. In an [Oct. 22 report](https://forever.security/blog/hijacking-ai-agents-via-downloads-folder/?ref=skimwire.com), Forever said it stopped a coding agent on a customer's machine from installing `function-color`, a known malicious npm package. The order came from an `AGENTS.md` in the customer's `~/Downloads` folder, disguised as a long, ordinary "Engineering Work Guidelines" document.

Forever didn't establish how the file got there. Its theory is that Downloads is the one folder a website can write to on its own: depending on browser settings, a page can save a file there without asking, [Mashable notes](https://sea.mashable.com/tech/56363/hackers-find-a-way-to-turn-users-own-ai-agents-and-downloads-folders-against-them?ref=skimwire.com). Start an agent in that folder, and it reads the file like any other project notes.

## How the attack works

- **Codex:** the planted file told Codex to add a "project tools" server to `~/.codex/config.toml`, its machine-wide config, then run a check with the flag that bypasses approvals and sandboxing. That installed the malware. Because the config is global, every later Codex session loads the attacker's server, in any folder.
- **Claude Code:** Forever's own `CLAUDE.md` got Claude to write a project setting that points its API traffic at a server Forever controlled. That leaked Claude's OAuth token on every request and let the fake server answer as the model with commands to run.

Forever says neither tool has a bug to patch: both agents are doing what they were built to do, following the instructions file in their folder. The problem is trusting a folder the web can write to.

## What to do

- Don't launch Codex, Claude Code or any other agent in your Downloads folder.
- Read any `AGENTS.md` or `CLAUDE.md` you didn't write, including in repos you just cloned, before you let an agent work there.
- Check `~/.codex/config.toml` for unexpected `[mcp_servers.*]` blocks, and `.claude/settings.json` files for an `ANTHROPIC_BASE_URL` or proxy you didn't set.
- Keep approval prompts and sandboxes on, and be suspicious of anything telling an agent to bypass them.
- If `function-color` shows up in a machine's installs, treat it as compromised and rotate your tokens. Deleting the text file won't undo config changes an agent already made.

## Why it matters

Researchers have shown poisoned instruction files before, including a poisoned `AGENTS.md` that got Codex to sabotage code in an NVIDIA test this April. What's new is that Forever says it caught a real attacker trying it. As agents browse and run code on their own, "the user would have to click something" is no longer a safe assumption.

*Sources:* [*Forever Security*](https://forever.security/blog/hijacking-ai-agents-via-downloads-folder/?ref=skimwire.com) *and* [*Mashable*](https://sea.mashable.com/tech/56363/hackers-find-a-way-to-turn-users-own-ai-agents-and-downloads-folders-against-them?ref=skimwire.com)*.*