A planted file in your Downloads folder can turn Codex and Claude Code against you
Forever caught a malicious AGENTS.md in a customer's Downloads folder that made a coding agent install malware. What to check and how to stay safe.
The skim
- Security firm Forever says it caught a real attack that used a plain-text
AGENTS.mdfile in a customer's Downloads folder to make an AI coding agent install malware. - In its tests, the real file got OpenAI's Codex to run the malicious package in more than 90% of attempts. A file Forever wrote for Claude Code worked about half the time and exposed its login token.
- The fix is on you: don't start coding agents in Downloads, read instruction files you didn't write, and keep sandboxes and approvals on.
What happened
Coding agents like Codex and Claude Code read instruction files, AGENTS.md or CLAUDE.md, from the folder they're started in, and follow them. In an Oct. 22 report, Forever said it stopped a coding agent on a customer's machine from installing function-color, a known malicious npm package. The order came from an AGENTS.md in the customer's ~/Downloads folder, disguised as a long, ordinary "Engineering Work Guidelines" document.
Forever didn't establish how the file got there. Its theory is that Downloads is the one folder a website can write to on its own: depending on browser settings, a page can save a file there without asking, Mashable notes. Start an agent in that folder, and it reads the file like any other project notes.
How the attack works
- Codex: the planted file told Codex to add a "project tools" server to
~/.codex/config.toml, its machine-wide config, then run a check with the flag that bypasses approvals and sandboxing. That installed the malware. Because the config is global, every later Codex session loads the attacker's server, in any folder. - Claude Code: Forever's own
CLAUDE.mdgot Claude to write a project setting that points its API traffic at a server Forever controlled. That leaked Claude's OAuth token on every request and let the fake server answer as the model with commands to run.
Forever says neither tool has a bug to patch: both agents are doing what they were built to do, following the instructions file in their folder. The problem is trusting a folder the web can write to.
What to do
- Don't launch Codex, Claude Code or any other agent in your Downloads folder.
- Read any
AGENTS.mdorCLAUDE.mdyou didn't write, including in repos you just cloned, before you let an agent work there. - Check
~/.codex/config.tomlfor unexpected[mcp_servers.*]blocks, and.claude/settings.jsonfiles for anANTHROPIC_BASE_URLor proxy you didn't set. - Keep approval prompts and sandboxes on, and be suspicious of anything telling an agent to bypass them.
- If
function-colorshows up in a machine's installs, treat it as compromised and rotate your tokens. Deleting the text file won't undo config changes an agent already made.
Why it matters
Researchers have shown poisoned instruction files before, including a poisoned AGENTS.md that got Codex to sabotage code in an NVIDIA test this April. What's new is that Forever says it caught a real attacker trying it. As agents browse and run code on their own, "the user would have to click something" is no longer a safe assumption.
Sources: Forever Security and Mashable.
