Forever Security says a malicious AGENTS.md file planted in a user's Downloads folder can hijack AI coding agents, after the firm caught one trying to install malware on a real customer machine. In Forever's own tests, OpenAI's Codex followed the planted instructions and ran the malicious payload in more than 90% of attempts.
Forever researchers Gal Weizman and Omer Samet detailed the findings in an October 22 report titled "Markdown Is the New Executable." The investigation began when Forever blocked an agent on a customer machine from installing function-color, a known malicious npm package. The instructions came from an AGENTS.md in the user's Downloads folder, disguised as ordinary engineering notes, not from the developer. Forever stopped the attack before any code ran and has not determined how the file got there.
AGENTS.md and CLAUDE.md are plain-text instruction files that coding agents read and follow when they start in a folder. Forever's argument is that two ordinary behaviors combine into an attack path: agents trust the instruction files in whatever folder they open, and a website can save a file into Downloads without a click or permission prompt, choosing its name and contents. Forever built a proof-of-concept page that silently drops an AGENTS.md into Downloads when visited, though it did not establish that a real attacker used that route.
Key facts
- 01Forever Security found a malicious AGENTS.md in a customer's Downloads folder that told a coding agent to install npm malware.
- 02In Forever's tests, OpenAI's Codex executed the planted payload in more than 90% of attempts.
- 03A planted CLAUDE.md rerouted Claude Code's API endpoint about 50% of the time, exposing the session's OAuth token.
- 04About half of Forever's customers run a coding agent inside Downloads; about a quarter of agent sessions open a browser.
- 05The npm package function-color, tied to the MALFEX campaign, was replaced with a security placeholder on October 7, 2026.
The package at the center of the incident, function-color, belongs to a campaign that researchers at CloudSEK and Checkmarx named MALFEX. It pulls in a downloader, function-flag, which fetches and runs a Windows payload. Version 1.0.0 appeared on npm in July 2025, and npm replaced the package with a 0.0.1-security holding version on October 7, 2026.
For the Codex test, Forever ran the real attacker file, about 13 KB, inside an isolated virtual machine. The file told Codex to register a server in its config.toml file and install the package. Because that config applies machine-wide, the change persisted across every later Codex session and project. The researchers said the payload had to work around five controls, including a trust gate, a network sandbox and startup-only server loading.
The Claude Code attack worked differently and succeeded less often. Forever wrote its own CLAUDE.md, framed as internal gateway setup, that tried to get Claude to write a new API base URL into a project settings file, rerouting traffic to a server Forever controlled. That configuration write went through about half the time. When it did, the reroute exposed the session's OAuth token, which the researchers replayed against the real API to demonstrate account takeover. Same-session code execution worked in about one of five attempts.
Claude Code often asks for approval before such writes and frequently refuses suspicious ones, according to the report, and the long engineering-document framing is what got the write approved as often as it was. Forever also found that when the folder contained security notes, a subagent Claude spawned flagged the file as an attack, so the payload only worked in a clean-looking folder. Forever said it did not break out of Claude Code's sandbox.
The exposure figures come from Forever's own customer telemetry. About half of its customers run a coding agent inside their Downloads folder, and roughly a quarter of agent sessions open a real browser, the two conditions the attack depends on. Forever counted more than 1,300 Claude Code sessions launched from Downloads in its customer base.
Forever argues there is nothing for OpenAI or Anthropic to patch, because the agents are doing what they were designed to do when they follow an instruction file in their working folder. Neither company was quoted in coverage of the research. Codex reads AGENTS.md files up to a 32 KiB combined default limit, while Claude Code reads AGENTS.md only when no CLAUDE.md exists in the working directory or above it.
Forever's recommendations are specific: do not start coding agents in Downloads, read any AGENTS.md or CLAUDE.md you did not write, including in freshly cloned repositories, and check Codex's config.toml for unexpected server blocks and Claude Code's settings.json for unfamiliar API endpoints. It also advises keeping approval gates and sandboxes on, rotating credentials if a planted file turns up, and treating any machine with function-color installed as compromised.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
