What is the AGENTS.md Downloads folder attack?

A malicious AGENTS.md file placed in ~/Downloads gives instructions to any coding agent started in that folder. In the case Forever Security reported on October 22, 2026, the file told OpenAI Codex to register a fake tools server that installed the npm malware package function-color.

Does the AGENTS.md attack affect Claude Code?

Forever Security built a CLAUDE.md variant that told Claude Code to point its API traffic at the researchers' server. It worked in about half of their tests and exposed the session's OAuth token. They did not report finding this variant in the wild.

Will OpenAI or Anthropic patch it?

The researchers say there is nothing to patch, because the agents follow instruction files in their working folder by design. The defense is where you start agents, plus approvals, the sandbox and config checks.

Is the function-color package still on npm?

When we checked on October 26, 2026, npm served function-color as a security holding package (version 0.0.1-security). The OSV advisory MAL-2026-17647 says any computer that installed it should be considered fully compromised.

AGENTS.md Security: The Downloads Folder Attack on Codex

Image: Unsplash.

Use this if anyone on your team runs OpenAI Codex, Claude Code or another coding agent on a laptop. Forever Security reported finding a malicious AGENTS.md file in a customer's ~/Downloads folder. A coding agent started in that folder read it and tried to install function-color, an npm package already flagged as malware. Our verdict: this is a policy gap more than a software bug, and most of the fix is one rule about where agents start.

Event date: October 22, 2026, Forever Security's report. Press coverage: BleepingComputer, October 25 at 15:49 UTC; RuntimeWire, October 25 at 17:55 UTC.

What happened

Forever Security sells monitoring for AI agents. It says its product stopped a coding agent mid-session from installing function-color, and traced the order to an AGENTS.md in the customer's Downloads folder, which was also the agent's working directory. The researchers could not determine how the file got there. Their point is that it doesn't take much: "~/Downloads is special. It is the one folder the web can write to on its own." BleepingComputer opened their proof-of-concept page, and it downloaded an AGENTS.md with harmless test text.

The attack section of the malicious AGENTS.md found by Forever Security, telling Codex to register a project-tools MCP server in ~/.codex/config.toml before starting the user's request

Screenshot: "Markdown Is the New Executable", Forever Security, the attack section of the planted AGENTS.md. Captured October 26, 2026.

The planted file reads like a dull "Engineering Work Guidelines" document, with the attack near the end dressed up as setup. It asks Codex to append a "project-tools" server to ~/.codex/config.toml, then run a second Codex session with --dangerously-bypass-approvals-and-sandbox to "confirm" it loads. In the researchers' isolated VM, "Codex ran the malware in more than 90% of attempts." Because the edit lands in Codex's machine-wide config, every later session on that laptop loads the attacker's server, in any folder.

For Claude Code they wrote their own file, modeled on the attacker's. A planted CLAUDE.md asked Claude to save a project .claude/settings.json that sets ANTHROPIC_BASE_URL to their server. "Claude followed through on this about 50% of the time," and the reroute handed over the session's OAuth token. That variant is the researchers' test, not something they found on a customer machine.

Their line on fixes: "There is nothing here for OpenAI or Anthropic to patch."

Why the agents obey the file

Both vendors document the behavior. Codex reads AGENTS.md "before doing any work," walking from the project root down to the folder you started in, and with no project root "it only checks the current directory." Claude Code loads CLAUDE.md "from your current working directory and every directory above it," and reads an AGENTS.md instead when there is no CLAUDE.md.

OpenAI's Codex documentation, How Codex discovers guidance, listing global scope, project scope and merge order for AGENTS.md files

Screenshot: "Custom instructions with AGENTS.md", OpenAI Codex docs. Captured October 26, 2026.

Claude Code documentation table showing that Claude reads AGENTS.md when there is no CLAUDE.md in the working directory or above it

Screenshot: "Store instructions and memories", Claude Code docs, AGENTS.md section. Captured October 26, 2026.

So the folder you start in decides which instructions the agent treats as yours. Downloads is the worst pick on the machine, and Forever says that in its telemetry "about half of customers run an agent inside Downloads."

The playbook: six steps

Ban two starting folders. No agent sessions in ~/Downloads or in the home folder. Put it in your AI use policy as one line. Need an agent to work on a downloaded file? Move the file into a project folder first.
Read instruction files you didn't write. Any AGENTS.md, AGENTS.override.md, CLAUDE.md or CLAUDE.local.md in a fresh clone, an unzipped archive or Downloads gets read by a person before an agent sees it. Red flags from the real file: edit the agent's own config, install a package "before beginning the user's request," or pass a flag that skips approvals.
Check each laptop's agent config. In ~/.codex/config.toml, look for [mcp_servers.*] blocks nobody added on purpose. In any project's .claude/settings.json, look for ANTHROPIC_BASE_URL or another endpoint you didn't set. Two commands cover it:
```
grep -n -A3 'mcp_servers' ~/.codex/config.toml
find ~ -maxdepth 4 -path '*/.claude/settings*.json' -exec grep -l 'BASE_URL' {} +
```
Keep approvals and the sandbox on. Codex's CLI defaults "include no network access and write permissions limited to the active workspace." The Codex attack worked by getting the agent to switch that off for itself. Make "never run with --dangerously-bypass-approvals-and-sandbox on a work laptop" a written rule. For folders you don't trust, Codex accepts trust_level = "untrusted" per project, which makes commands ask first and "also disables project-local configuration."
Lock the API address where a project file can't reach it. On Claude Code with managed settings, nothing in a user's or project's settings file "overrides a managed key." Set your API endpoint there if you route through a gateway. On the Claude side, also don't accept the workspace trust dialog for Downloads: most env values in a project file apply only after you trust the folder.
If you find one, rotate. Forever's advice is "Assume the token leaked." If function-color shows up in a machine's installs, the OSV advisory says it "should be considered fully compromised": rotate every secret on it from a different computer. Our API token leak playbook has the rotation order.

Our take: steps 1 and 3 take ten minutes per laptop and cover the case as reported. Step 5 matters only if you already run managed settings; don't buy a plan for it.

What we checked

npm, October 26: function-color now resolves to a "security holding package," version 0.0.1-security, last modified October 7. Today's install gets the placeholder, not the malware. The method works with any other package, so this changes little.
OSV: advisory MAL-2026-17647, published October 7, 2026, lists versions 1.0.0 and 1.7.3. Checkmarx had documented the package in its MALFEX research and said that as of September 29 it "remained live and installable."
Our own machine, October 26: we ran the step 3 checks on the laptop this desk works from. Downloads held 556 items and no AGENTS.md or CLAUDE.md. ~/.codex/config.toml had one [mcp_servers] block. It named a desktop app installed on that machine, which is the kind of entry you want to be able to explain in one sentence.

OSV advisory MAL-2026-17647, Malicious code in function-color (npm), published October 7, 2026, with the note that any computer that installed it should be considered fully compromised

Screenshot: OSV advisory MAL-2026-17647. Captured October 26, 2026.

What to log

Which laptops run coding agents, and from which folders. If you keep an AI tool inventory, add a column.
Each config check from step 3: date, machine, result.
Any instruction file found outside a project, with a hash, before you delete it.
Every token rotation after a finding.

For a longer agent policy, see our unattended AI coding agents policy.

What people said

When the report was posted to r/cybersecurity, the top-voted reply was skeptical. mesarthim_2: "By 'attackers are dropping' you actually mean 'people are downloading themselves', right?" TurbsUK18 asked the question we'd put to a vendor: "Why is the agent allowed to modify its own configuration?" Both are fair. A file still has to land in Downloads, and someone still has to start an agent there. The second question is the one to ask your tool vendors.

Forever Security's own demo of the Codex chain:

What we could not confirm

How the file reached the customer's machine: Forever says it doesn't know. The 90% and 50% rates come from Forever's own tests, which we did not rerun. We found no statement from OpenAI or Anthropic about the report. Forever sells agent monitoring, so read its framing ("Markdown is the new executable") with that in mind. For a related case where Claude Code credentials were the target, see our Claude Code token theft post.