A planted AGENTS.md or CLAUDE.md in Downloads can hijack Codex or Claude Code

What Forever found

Forever Security, a company that monitors AI agents for its customers, published its report on October 22, 2026. It began with an alert: on a customer’s computer, a coding agent was about to install function-color, an npm package Checkmarx had documented as malware. Forever says it stopped the install “before any code ran.”

The order hadn’t come from a dependency or a repository. It came from an AGENTS.md file in the customer’s ~/Downloads folder, the folder the agent was working in. The file is a 13 KB document of “Engineering Work Guidelines,” with the attack in one section near the end, dressed up as routine setup for a “project tools” server. Forever doesn’t know how the file got there.

Its point is about the folder. In the report’s words: “~/Downloads is special. It is the one folder the web can write to on its own.” A coding agent treats an AGENTS.md in its folder as instructions to follow, so, as Forever puts it, “a web page can download a file named AGENTS.md into your Downloads folder, silently.” BleepingComputer checked Forever’s demonstration page and confirmed it downloads an AGENTS.md, with harmless contents.

What the files made the agents do

Codex. Forever ran the customer’s own file inside an isolated virtual machine. Asked anything at all, Codex first added a server entry to ~/.codex/config.toml, its configuration for the whole computer, then started a second Codex with --dangerously-bypass-approvals-and-sandbox, a flag the file presents as needed for the install. The entry hands npm install function-color to launchctl, a macOS tool, so it runs outside Codex’s control. “In our testing, Codex ran the malware in more than 90% of attempts,” Forever says. Because the entry sits in the machine-wide config, every later Codex session loads it, in any folder.

Claude Code. Forever wrote its own CLAUDE.md for Claude, modeled on the attackers’ file. It asks Claude to save an ANTHROPIC_BASE_URL pointing at the researchers’ server in the folder’s .claude/settings.json, so that Claude Code sends its requests, and its login token, there. Forever calls Claude “much harder to fool,” and says it wrote the setting “about half the time.” The token was enough on its own: Forever replayed a captured one against Anthropic’s API and was served as the account’s owner. From the next launch in that folder, the server could answer as the model and have Claude run commands with its sandbox turned off. In about a fifth of runs, it got code running in the first session too.

Forever’s conclusion: “There is nothing here for OpenAI or Anthropic to patch.” Each agent did what it’s built to do with an instructions file in its folder.

Which agents read these files

Forever tested Codex and Claude Code. By their own documentation, most coding agents read an AGENTS.md in the folder they work in:

Agent	Instruction files it reads in your folder	Forever’s result
Codex	AGENTS.md or AGENTS.override.md, from the project root down to the folder you start in	Ran the payload in over 90% of attempts
Claude Code	CLAUDE.md, or AGENTS.md when neither the folder nor any above it has a CLAUDE.md	Rerouted its traffic about half the time
OpenCode	AGENTS.md, or CLAUDE.md if there’s none, looking upward from the current folder	Not tested
Cursor	AGENTS.md in the project root and its subfolders	Not tested
Antigravity	AGENTS.md or GEMINI.md in the workspace and its subfolders	Not tested

The rows come from each agent’s documentation: Codex’s guide, Claude Code’s docs, OpenCode’s rules, Cursor’s rules and Antigravity’s rules. Claude Code reads AGENTS.md from version 2.1.277 on.

Who’s at risk

You’re exposed if you start a coding agent in your Downloads folder, or in any folder holding files you haven’t read. Forever says about half of its customers run a coding agent inside Downloads. Gal Weizman, one of the report’s two authors, told BleepingComputer that people use agents there to organize the folder or act on new downloads, that hundreds of Forever’s customers run Claude Code, Codex and the Cursor CLI from it, and that Claude Code alone launched more than 1,300 sessions there.

Browsers make the first step easy. BleepingComputer notes that Chrome, Edge and Firefox save downloads to ~/Downloads by default without asking where, though each shows a download notification; Brave asks first. And an agent that browses for you can fetch the file itself: Forever says about a quarter of the agent sessions it sees open a real browser.

Your approval settings matter. Codex recommends read-only for a folder that isn’t under version control, as Downloads usually isn’t, and may start read-only until you trust the folder; Forever says that once you’ve worked in Downloads, Codex trusts it. In Claude Code, writes to a .claude folder are protected: Manual and Accept edits ask you, Bypass permissions allows them, and Auto, the default for new Claude Code sessions on Pro, Max and Team plans since August 14, leaves the decision to its classifier.

The known payload is narrower than the technique. By Checkmarx’s analysis, function-color installs function-flag, whose download routine runs only on Windows and fails silently on macOS and Linux, and its download server wasn’t responding when Checkmarx looked. npm’s registry has served a “security holding package” under the function-color name since October 7, 2026. None of that stops a new file from naming a different package.

How to check your computer

1. Look for instructions files you didn’t write. In Downloads, and in any folder you’ve started an agent in, look for AGENTS.md, AGENTS.override.md, CLAUDE.md, GEMINI.md or a .claude folder, and read one before an agent does. On a Mac or Linux:

   ls -la ~/Downloads | grep -iE 'agents|claude|gemini'

2. Check Codex’s settings. In ~/.codex/config.toml, look for an [mcp_servers.…] entry you didn’t add, project-tools especially, and a changed chatgpt_base_url, which Forever also names.

3. Check Claude Code’s settings. In each project’s .claude/settings.json, look for an ANTHROPIC_BASE_URL, a proxy, or any address you didn’t set.

4. Look for the real file’s traces. On a Mac, its entry starts a launchd job named com.ptools.setup and installs into /tmp/ptools. If either command prints anything, the entry has run. Finding nothing doesn’t prove it never did, so the settings checks above count for more:

   launchctl list | grep ptools
   ls -d /tmp/ptools 2>/dev/null

If function-color turns up in a computer’s installs, Forever says to treat that computer as compromised.

If you find one

• Delete the file and the settings it added, then restart the agent. Codex and Claude Code load these settings when a session starts, so a running session keeps what it loaded.
• Replace your logins. Forever says to “assume the token leaked.” For Claude Code, remove its sign-in under Settings > Account on claude.ai, or its token under Settings > Claude Code, as Anthropic’s help describes. For Codex, run codex logout, use Log out of all sessions in ChatGPT’s active sessions, and sign in again.
• If a package the file named actually ran, treat it as a malware infection and replace every key that computer held. Our LiteLLM memo lists the agent logins to cover.

Keeping agents out of Downloads

The fix Forever and BleepingComputer agree on is where you start the agent: in the folder of the project you’re working on. Not Downloads, and not your home folder either, where Claude Code won’t save your trust and asks again at every launch. Move a file you want an agent to work on into the project first. Keep approvals and sandboxes on, and distrust any instructions that tell an agent to turn them off.

In Enjoy, every agent works in the folder of the project you open, and a new project starts as an empty folder of its own, which Enjoy suggests putting in Documents. Instructions you write in Enjoy’s Project settings are kept in Enjoy rather than as a file in the folder. The agents still read any AGENTS.md or CLAUDE.md in the folder, so don’t open Downloads as a project. Each agent keeps its own permission modes, and its requests appear as cards to allow or decline. The exception is Antigravity: Enjoy can’t show its approval requests, so by default it runs without asking. Give it only folders you made.

What hasn’t been said

• How the file reached the customer’s computer. “Nobody knew how it got there,” the report says. Forever showed that a web page can plant the file, not that one did.
• Which settings Forever’s agents ran with. The report doesn’t give the agents’ versions, models or permission modes, so it’s unclear how its success rates carry over to your setup.
• Anything from OpenAI, Anthropic or npm. Neither BleepingComputer’s report nor The Hacker News’s carries a statement from any of them, and we found no public comment from them by October 26.
• Whether other agents fall for it. Cursor, OpenCode, Antigravity and others read AGENTS.md too, but no one has published tests of them.