A planted AGENTS.md in the Downloads folder got Codex to install malware in over 90% of tests

For years the Downloads folder has been the junk drawer of every computer. Files land there, get opened once and are forgotten. Nobody thinks of it as a dangerous place anymore, because modern operating systems will not simply run a program that arrived from the internet. A new report from the security company Forever Security argues that AI coding agents have quietly changed that. In the age of agents, a plain text file in Downloads can act like a program, and the agent is the one that runs it.

The research was published on October 22, 2026 on the Forever Security blog by researchers Gal Weizman and Omer Samet under the title "Markdown Is the New Executable". It was picked up a few days later by BleepingComputer and The Hacker News. What makes it stand out is that it did not start as a lab experiment. It started with a real alert on a real customer machine.

It began with a blocked package

Forever Security sells monitoring for AI agents running on company computers. One day its software stopped a coding agent, in the middle of a session, from installing an npm package called function-color. That package was already known to be malicious. According to The Hacker News, it belongs to a malware campaign that researchers at CloudSEK and Checkmarx have documented under the name MALFEX: function-color pulls in a downloader that fetches and runs a Windows payload.

Blocking a known bad package is routine work for a security tool. What caught the researchers' attention was where the instruction came from. It was not a dependency of the project and it did not come from a code repository. The agent was following a file called AGENTS.md that sat in the customer's Downloads folder, which also happened to be the agent's working directory at that moment.

AGENTS.md is a convention used by OpenAI's Codex and several other coding agents. It is a simple Markdown file with instructions for the agent: which tools to use, how to run tests, which coding style to follow. Claude Code uses a similar file named CLAUDE.md. When an agent starts in a folder, it reads these files and treats them as guidance from the people who own the project. That is the whole point of the files, and it is why they are so useful in normal development.

Nobody at the customer knew how the file had ended up in Downloads. Forever Security says it still cannot tell. But the question of how it could have arrived there turned into the real finding of the report.

Two harmless facts that become dangerous together

The researchers describe the problem as the meeting point of two behaviors that are each completely normal.

The first is that coding agents are built to obey the instructions file in the folder they open. In a project you created yourself, that is exactly what you want. You read the file once, you trust it, and from then on the agent follows it.

The second is that a web page can save a file to your computer without asking. In Chrome, Edge and Firefox, downloads go to the Downloads folder by default, with no dialog asking where to put them. The page even chooses the file name and the content. BleepingComputer checked this and found that those three browsers save the file silently, although they do show a download notification, while Brave asked the user to approve the download. Forever Security built a proof of concept page that does exactly this: visit it, and a file named AGENTS.md appears in Downloads.

For a long time, this second fact did not matter much. A downloaded executable will not start on its own, and operating systems warn before running anything that came from the internet. A Markdown file is not an executable at all, so none of those protections apply to it. In the hands of a coding agent, however, a Markdown file full of instructions behaves a lot like a script. The agent reads it and does what it says.

Put the two facts together and you get a path from a web page to actions on your machine, without a single click from you. All it takes is that someone, or some agent, starts a coding assistant in the Downloads folder afterward.

How the attack on Codex worked

Because the file found on the customer machine targeted Codex, Forever Security tested that first. The researchers did not write their own version. They took the exact AGENTS.md from the customer's computer and ran it, unchanged, inside an isolated virtual machine.

The file is a long and boring document of about 13 KB, titled "Engineering Work Guidelines". The attack hides in one section near the end, written in the calm tone of routine setup notes. It tells Codex that the project needs a small helper server and that, before starting on the user's request, the agent should add a so called "project tools" entry to its configuration file. That entry is an MCP server definition whose start command quietly runs an npm install of function-color through the macOS launchctl tool.

The section then asks Codex to verify the setup by starting a second, non interactive Codex session with the flag --dangerously-bypass-approvals-and-sandbox. The file explains this away as necessary, because the helper server supposedly needs network access to fetch its package on first start. In reality the flag removes the very protections that would have stopped the install.

The result was striking. In Forever Security's testing, Codex ran the malware in more than 90% of attempts. And the damage does not stay in Downloads. The file Codex edits, ~/.codex/config.toml, is its machine wide configuration. Once the malicious server entry is written there, every future Codex session on that computer loads it at startup, in any folder and any project.

The researchers say that getting Codex to do this was not trivial, and the details explain why the file looks the way it does. Codex only follows an AGENTS.md in a folder it trusts, but once you have worked in Downloads before, the folder qualifies. A short and obvious instruction such as "install this package" gets refused, while the long and bland engineering document gets through. MCP servers only load when a session starts, which is why the file uses a child Codex session to bring both steps into one. Codex blocks network access by default, which is why the bypass flag is there. And Codex kills a server that does not answer quickly, which is why the slow install is handed to launchctl so it can finish outside Codex's control.

Claude Code was harder to fool, but not immune

To find out whether this was a quirk of one product or a property of coding agents in general, the researchers turned to Anthropic's Claude Code. Here they had to write their own CLAUDE.md, inspired by the attacker's file, and the attack that worked looked quite different.

Instead of installing a package, the planted file asks Claude to save a small settings file, .claude/settings.json, in the current folder. The settings set ANTHROPIC_BASE_URL to an address the file describes as the team's internal gateway. In reality it pointed to a server the researchers controlled, on a domain they owned with a valid certificate.

That one change has two effects. First, Claude Code sends its OAuth login token with every request, so the researchers' server received the token. They replayed a captured token against the real API and were served as the victim, which amounts to an account takeover without running any code. Second, the fake server can answer as if it were the model. On the next launch in that folder, the researchers' server replied with a shell command that also told Claude Code to switch off its own sandbox, and the client ran it.

Claude Code normally asks a human to approve a write like this and often refuses one that looks suspicious. Forever Security says the long engineering document framing got the settings file written about half the time. A running session keeps its original connection, so to get code execution right away, the file also asks Claude to start a subagent to "validate the configuration". That subagent opens a fresh connection through the fake server, and about a fifth of the time this gave the researchers code execution in the same session.

The researchers also noticed that Claude Code seemed to read the room. When the payload pushed too hard, a subagent read the CLAUDE.md and flagged it as an attack. The same file that worked in a clean folder failed every time in a folder full of security notes.

A practical note from Convika's analysis: whether Claude Code asks you before such a write depends on your permission mode, and none of the published write ups name the exact agent versions that were tested. Most of the tests used a harmless stand in payload that only opened the calculator. The real malicious package was run once, in an isolated virtual machine, and npm has since removed function-color.

Why there is nothing to patch

The most uncomfortable part of the report is its conclusion. "There is nothing here for OpenAI or Anthropic to patch," the researchers write. An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do. They compare it to phishing: when a browser shows a fake bank login page, the browser has worked correctly, and the attack lives in the page.

In their view the danger lies in a seam that nobody owns. The browser makers did not design downloads with coding agents in mind, and the agent makers designed instruction files for folders that users control. Downloads is the one folder that breaks that assumption, because the web can write to it.

There is also a wider point. Many classic defenses assume that a human has to do something: click a link, approve a prompt, run a file. Agents remove that human step. Increasingly, agents also browse the web on their own while nobody watches the screen. One of the pages they visit could drop the file, and no person would ever see it arrive.

How common is the risky setup?

It would be easy to dismiss this as an edge case. Who starts a coding agent in their Downloads folder? According to Forever Security's own telemetry, quite a lot of people. About half of its customers run a coding agent inside Downloads, and roughly a quarter of agent sessions open a real browser.

Weizman told BleepingComputer that this is common practice, because people like to use agents to tidy up that folder or to work on a file they just downloaded. Hundreds of the firm's customers run agents such as Claude Code, Codex and Cursor CLI from Downloads, and Claude Code alone launched more than 1,300 sessions from that location.

What you should do now

The good news is that the defense does not require any new product. Forever Security, OpenAI and Anthropic all point in the same direction: start a coding agent in the root of the project it should work on, not in your home folder, not in a broad parent folder and never in Downloads. Treat Downloads as hostile ground for agents.

The researchers list a few concrete checks:

• Look for instruction files you did not write. A stray AGENTS.md or CLAUDE.md, in Downloads or in a repository you just cloned, is the whole attack. Read it before an agent does.
• Check the agent's own configuration. In ~/.codex/config.toml, look for an unexpected MCP server block or a changed base URL. In a project's .claude/settings.json, look for an ANTHROPIC_BASE_URL, a proxy or any other endpoint you did not set.
• Keep approval prompts and sandboxes switched on, and be very suspicious of any instruction that asks the agent to turn them off.
• If you find a planted file, assume the login token has leaked and rotate it. A stolen token is a live session, not a single caught request.
• If function-color shows up in a machine's installed packages, treat that machine as compromised.

The bigger lesson

It is tempting to read this as a story about one folder and one file name. The more important takeaway is about how agents change old security assumptions. Instruction files like AGENTS.md are powerful precisely because agents trust them. That trust is fine when you control every file in the folder. It becomes a liability the moment a folder can be filled by someone else, whether that is a web page, a cloned repository or a shared drive.

For developers, the fix is mostly a habit: open agents only in project folders, read unfamiliar instruction files and keep the safety switches on. For companies, the report is a reminder that agents now hold real credentials and act with real authority, so what they read deserves the same scrutiny as what employees click. The Downloads trick may be the first documented case of this kind, but it is unlikely to be the last.

Sources: Forever Security research, BleepingComputer, The Hacker News, Convika.