Malicious AGENTS.md File in Downloads Fooled Codex in Over 90% of Tests

A text file sitting in a Downloads folder was enough to turn an AI coding assistant against its owner. Security firm Forever Security says it caught a malicious AGENTS.md file on a customer's machine that told a coding agent to install malware, and in follow up tests OpenAI's Codex obeyed a copy of it in more than 90% of attempts, according to The Hacker News.

Forever stopped the agent before any code ran on the customer's computer, and it could not say how the file got there. The firm then built a web page that could plant such a file without a single click and tested the idea against two popular coding agents. The results were very different.

Two harmless habits that add up to an attack

The trick depends on two behaviors that are fine on their own. Coding agents read and follow an instructions file (AGENTS.md for Codex, CLAUDE.md for Claude Code) in whatever folder they are started in. And a web page can save a file into Downloads without a click or a permission prompt, choosing both the name and the contents.

Combine them and anyone who launches an agent inside Downloads hands control to whatever file landed there last. Forever's own telemetry suggests that is common: about half of its customers run a coding agent in their Downloads folder, and roughly a quarter of agent sessions open a browser.

The file Forever found was dressed up as ordinary engineering notes. Its real job was to get the agent to install an npm package called function-color.

The malware behind function-color

function-color is part of a campaign that Checkmarx and CloudSEK track as MALFEX. In an October 5 report, Checkmarx said a single operator has published 12 npm packages since August 2023, 8 of them malicious. function-color installs a second package, function-flag, which downloads and runs an executable.

function-flag alone accounted for 37,419 of the campaign's 40,767 lifetime downloads, according to Checkmarx, and both packages were still installable as of late September with no advisory. Other packages in the same campaign deliver the Overlord remote access trojan and a stealer that goes after Discord, browsers, Telegram and crypto wallets. All of the payloads target Windows and fail on macOS and Linux.

Codex and Claude Code under the same attack

OpenAI Codex

Forever ran the real attacker file against Codex in an isolated virtual machine. Framed as routine project setup, it told Codex to register a server in its global config file (~/.codex/config.toml) and to install the package.

That config applies to every session, so the malicious server would keep loading in any folder afterward, not just Downloads. Codex ran the malware in more than 90% of attempts.

Anthropic Claude Code

For Claude Code, Forever wrote its own planted CLAUDE.md, presented as internal gateway setup. It tried to get Claude to write an ANTHROPIC_BASE_URL value into a project settings file, which would send the agent's API traffic through a server Forever controlled.

The payoff there is different. The session's login token leaks, which can lead to account takeover, and the rogue server can pretend to be the model and send back commands of its own. Claude asks for approval before writes like this and often refuses suspicious ones. Even so, the long engineering doc framing got the write approved about half the time.

How the two results compare

Codex failed more often in these tests, but the attack it faced only asked for normal developer chores. Claude Code's approval step caught many attempts, yet a 50% success rate against a stolen login is not comfort. Forever argues there is nothing for OpenAI or Anthropic to patch, since each agent did what it was built to do, and compares it to a browser showing a phishing page. The Hacker News reported no statement from either company.

Who should worry most

• Windows developers using Codex: the highest risk in these tests, since the MALFEX payloads run on Windows and the config change sticks around for future sessions.
• Claude Code users on any system: fewer successful attempts, but the prize is your login token, so an unexpected base URL change should be treated as a breach.
• Mac and Linux users: these particular payloads fail on your systems, but the next planted file could carry something that does not.
• Teams that clone lots of repositories: the same instruction file trick works in any folder, not only Downloads.

Five checks that close the gap

1. Never start Codex, Claude Code or any other agent inside your Downloads folder.
2. Read any AGENTS.md or CLAUDE.md you did not write, including files in repositories you just cloned.
3. Open ~/.codex/config.toml and look for server entries or base URLs you do not recognize.
4. Check .claude/settings.json for an ANTHROPIC_BASE_URL or other endpoint you never set.
5. Keep approval prompts and sandboxes switched on, and distrust any file that tells the agent to turn them off.

If you do find a planted file, Forever says to assume the login token leaked and rotate it right away. Our 10 minute account security routine is a good follow up.

Coding agents are now part of daily work for many developers, a shift that even reached the Linux kernel when Linus Torvalds used Claude Code on the page cache. Our primer on how AI agents work explains why they trust local files so readily, and attacks on the developer toolchain keep coming, from the PHP2Shell flaws to the ConnectWise breach. One last figure from Forever is worth repeating: about half of its customers already run a coding agent from the very folder this attack depends on. More security coverage lives in our tech section.