Malicious AGENTS.md in Downloads: how a text file hijacks AI coding agents
A 13 KB text file, an ordinary-looking set of “engineering guidelines,” left in the Downloads folder. That is what the Forever Security team says it found on a real customer’s machine, in research published October 22, 2026. The file was called AGENTS.md, and it was written to give orders to an AI coding agent.
If anyone at your company uses Codex, Claude Code or a similar tool, even for small scripts or the website, this story is for you.
What is an AGENTS.md file?
Coding agents such as OpenAI Codex automatically read an AGENTS.md file (CLAUDE.md for Claude Code) in the folder where they start. The file normally describes the project’s rules: code style, test commands, things to avoid. The agent treats it as instructions. That’s useful, and it’s exactly the problem: anyone who can drop the file in the right place can give the agent instructions.
What Forever Security found
According to Forever Security, the attack was stopped before any code ran. The researchers don’t know how the file reached the machine. Their starting point is simple: based on their data, about half of their customers run a coding agent from the Downloads folder, and BleepingComputer reports that Claude Code launched more than 1,300 sessions there.
⬇️
1. The file lands
An AGENTS.md shows up in Downloads. Chrome, Edge and Firefox save files there without asking by default.
💻
2. The agent starts in the wrong place
A developer launches their coding agent from Downloads, or a folder above it.
📖
3. The agent reads its “guidelines”
Agents automatically read this file as project instructions.
⚙️
4. The configuration is changed
A tool server (MCP) is added to Codex’s configuration, installing a malicious npm package.
🔓
5. The guardrails come off
A second Codex session is launched with no approvals and no sandbox.
The trap, line by line
What the “guidelines” were hiding
1A new tool server in Codex’s global configuration: it stays there for every later session.
2A package since removed from npm. According to Forever Security, it belongs to the MALFEX campaign documented by Checkmarx and CloudSEK, and pulls in another package, function-flag.
3A child session that explicitly bypasses approvals and the sandbox.
Simplified reconstruction based on Forever Security’s description. The real file was about 13 KB.
Nothing in these lines is a vulnerability in the usual sense. The agent does what it’s told, in the folder where it was launched. As the researchers put it, there’s nothing here for OpenAI or Anthropic to patch: it comes down to habits and configuration.
Codex and Claude Code: two versions of the same AGENTS.md trap
Forever Security also tested a CLAUDE.md version against Claude Code. The goal changed: instead of running code, leak the account token.
| OpenAI Codex | Claude Code | |
|---|---|---|
| File read automatically | AGENTS.md | CLAUDE.md |
| What the planted file made it do | Add an MCP server that installs a malicious npm package, then start a session with no guardrails | Write ANTHROPIC_BASE_URL into .claude/settings.json to redirect traffic |
| Result | Code execution on the machine | Leak of the account’s OAuth token |
| Success rate in Forever Security’s tests | More than 90% | About half for the token leak, about one fifth for code execution in the same session |
These rates come from the researchers’ tests, under their conditions. Mostly they show the trap works often, not that it would work as often at your company.
This isn’t the first time AI tools have served as a way in: we’ve covered the Aurora ransomware and coding assistants, stolen AI API keys and malicious custom GPTs.
Five rules for your team
📂
Always from the project
Launch the agent at the root of the project repository. Never from Downloads, the Desktop or the home folder.
👀
Read before you trust
An AGENTS.md or CLAUDE.md you didn’t write gets read before you launch the agent, like a script.
🛡️
Keep approvals on
Leave the sandbox and approval prompts enabled. “No confirmation” modes stay the exception.
❓
Ask where to save
Turn on the browser setting that asks where to save each file. Brave already does this by default, according to Forever Security.
🏢
Managed settings
For a team, enforce agent settings centrally instead of relying on each machine.
If you find an unknown AGENTS.md
Don’t relaunch the agent in that folder
Move the file to a quarantine folder to examine it, without opening it with the agent.
Check Codex’s configuration
~/.codex/config.toml
Look for [mcp_servers.*] sections you didn’t add, or an unexpected chatgpt_base_url value.
Check Claude Code’s configuration
~/.claude/settings.json and .claude/settings.json
Look for an ANTHROPIC_BASE_URL variable you didn’t set.
Look for recently installed npm packages
npm ls -g --depth=0
Check in particular for function-color and function-flag, named by Forever Security.
Rotate tokens and keys
Agent tokens, API keys and other secrets reachable from that machine. Assume they may have been read.
These checks require knowing where to look on each machine. Our cybersecurity services include an inventory of installed AI tools and their settings, and our automated 24/7 monitoring with on-call technician intervention flags unusual behaviour on monitored machines, such as a process installing packages or contacting an unknown server.
Book your free cyber check
Do people on your team use AI coding agents, or are you not sure which ones? The free cyber check reviews the tools installed, their access, and the settings to fix first.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Sources
- Forever Security (Gal Weizman and Omer Samet, October 22, 2026): Hijacking AI agents via the Downloads folder
- BleepingComputer (Bill Toulas, October 25, 2026): AI coding agents hijacked using AGENTS.md file in Downloads folder
- The Hacker News: Malicious file in Downloads folder
- Help Net Security (October 26, 2026): AI coding agents, malware and OpenAI Codex
Photo: Nemuel Sereti, Pexels (Pexels licence).