- Forever Security says a planted AGENTS.md in a customer's Downloads folder steered a coding agent toward a malicious npm package, and it reproduced the attack on Codex and Claude Code.
- The researchers say there is nothing to patch, because the agents follow instruction files as designed. Folder trust, not a single bug, is the exposure.
- Leaders should find out where agents are launched, keep approval gates on, and check agent config files for unexpected servers or API addresses.
The folder you trust can be changed from the web
Most security rules rest on a quiet assumption: the folder you work in stays as you left it. New research from Forever Security shows how that assumption weakens when the worker is an AI coding agent.
The company monitors risks from AI agents. Its researchers saw a coding agent on a real customer's machine try to install an npm package called function-color. Forever describes it as known malware from a campaign that went unnoticed for roughly two years.
The package was not the odd part. The instruction came from an AGENTS.md file in the customer's ~/Downloads folder. Forever says nobody knew how it got there.
How the attack works
AGENTS.md is a plain-text file of instructions for coding agents. Agents such as OpenAI's Codex read it from the folder they open and follow it. That is the design.
Forever's point is that a web page can save a file into Downloads on its own. It says there is no click and no approval. Operating systems stop downloaded programs from running without consent. A text file is not a program, so those guardrails do not apply. It sits there until an agent reads it.
The file Forever recovered was a long, bland "Engineering Work Guidelines" document of about 13 KB. One section near the end looked like routine setup. In Forever's tests, it led Codex to edit its own machine-wide config file, ~/.codex/config.toml, and to add a "project tools" server. That server installed the package from npm.
Because the config is machine-wide, the researchers say every later Codex session loads the attacker's server, in any folder.
Claude Code proved harder to fool. Forever's planted CLAUDE.md tried to write a setting called ANTHROPIC_BASE_URL into the project's .claude/settings.json. That setting points the agent's traffic at a server the attackers control. The researchers say this leaks Claude's OAuth login token, which is account takeover without running any code. It also lets the server answer as if it were the model and send back commands.
What the numbers say, and what they do not
In Forever's Codex tests, the attack chain worked in more than nine of every ten attempts. Claude followed through roughly half the time, and reached same-session code execution about one time in five. Most tests used a harmless stand-in that opens a calculator. Forever says it ran the real package once, inside an isolated virtual machine.
Forever also draws on its own customer telemetry. It says about half of its customers run an agent inside Downloads. It adds that roughly one agent session in four opens a real browser, which matters because an agent that browses can fetch the planting page itself.
Forever researcher Gal Weizman told BleepingComputer that hundreds of customers launch agents from that folder. By his count, a single tool, Claude Code, started over 1,300 sessions there.
These are one vendor's figures, from its own customers. Forever sells agent monitoring.
There are limits. The researchers could not determine how the file reached the customer's machine. BleepingComputer tested the proof-of-concept page and got a harmless AGENTS.md. It reports that Chrome, Edge and Firefox save to Downloads without asking by default, but show a download notification. Brave asked the user to approve the download. The attack also needs someone to start an agent in that folder.
The real lesson: the person was the safeguard
Forever says there is nothing for OpenAI or Anthropic to patch. The agents do what they were built to do. The researchers compare it to a phishing page: the browser renders it correctly, and the harm sits in the page.
This shows a wider shift. Many defences quietly relied on a person in the loop, someone who clicks, reads and approves. An agent that reads untrusted files and holds your credentials removes that person. The old advice "the user would have to do something" stops protecting anyone.
The exposure is a matter of where agents are allowed to work, not only which tool is installed. Folders written to by the web and trusted by software are the weak spot.
What leaders should ask
Forever's advice is practical and costs little. Ask your teams these questions.
First, do any agents start in Downloads? Forever says to avoid it. Second, who checks stray AGENTS.md or CLAUDE.md files, including in freshly cloned repositories? Third, does anyone review agent config? Forever suggests looking in ~/.codex/config.toml for unexpected [mcp_servers.*] blocks or a changed chatgpt_base_url. In .claude/settings.json, look for an ANTHROPIC_BASE_URL you did not set.
Fourth, are approval gates and sandboxes still on? Forever says to be suspicious of any file telling an agent to bypass them. Finally, if you find a suspect file, rotate tokens and assume they leaked. If function-color appears in a machine's installs, Forever says to treat that machine as compromised.
The lesson is simple. An agent trusts its folder, so the folder needs a guard.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Forever Security.
