Forever Security said a coding agent at a real customer tried to install function-color, a malicious npm package (a shared code library). The cause was an AGENTS.md instructions file in the customer's Downloads folder. BleepingComputer also reported it. Forever says Downloads is the one folder a web page can write to, with no click needed. In its tests, Codex ran the planted payload in more than 90% of attempts, but most tests used a harmless stand-in that opens a calculator. The real package ran once, in an isolated virtual machine.
Forever says the file is a long, bland engineering guide with one setup section near the end. For Codex, that section makes the agent add a tool server to its own machine-wide config, so the attacker's install runs at each later start. The Claude Code version redirects the agent's API address, which leaks the user's login token. It worked about half the time. Both need an agent started in Downloads, which Forever says about half its customers do. Nobody knows how the file arrived, and the sources do not name who planted it.
Forever argues this is a design trait, not a bug, so OpenAI and Anthropic have nothing to patch. The sources include no reply from either. Buyers can ask where agents are launched, who sees changes to agent config files, and whether approval prompts stay on.