A planted AGENTS.md file in Downloads can turn your AI coding agent against you

Security firm Forever Security reported on October 22, 2026 that it stopped an AI coding agent from installing a known malicious npm package after the agent followed an instruction file planted in a user's Downloads folder. In the firm's own tests, OpenAI Codex and Anthropic's Claude Code could be steered the same way. There is no patch: the fix is a habit — never start a coding agent in Downloads or another catch-all folder, and read instruction files you did not write.

What happened, in plain English

AI coding agents are assistants that run in a terminal or editor and can read files, write code and run commands on your machine. Popular ones include OpenAI Codex, Anthropic's Claude Code and Cursor. To work well on a project, they automatically read a plain-text "briefing" file from the folder they are started in — AGENTS.md for Codex, CLAUDE.md for Claude Code — and treat what it says as instructions.

Forever Security's researchers Gal Weizman and Omer Samet describe what happens when that briefing file is not yours. Their product stopped an agent mid-session from installing function-color, an npm (the Node.js package registry) package the researchers describe as known-malicious and which, they say, npm has since removed. The cause was an AGENTS.md file in the customer's ~/Downloads folder, dressed up as ordinary engineering notes. The customer did not know how it got there.

The researchers say a web page can save a file into Downloads without any click, choosing its name and contents. Operating systems treat a downloaded program with suspicion, but a text file looks harmless — until an AI agent reads it as orders.

Think of a new employee who obeys any memo pinned to the noticeboard of the room they happen to sit in. If you sit them in the mailroom, anyone who can slip paper into the mailroom can give them orders.

Forever says that, in its telemetry, about half of its customers run a coding agent inside their Downloads folder. These figures come from the vendor and have not been independently verified.

Are you affected? What to do now

You should care if anyone in your organisation — developers, DevOps, data analysts, IT staff writing scripts — uses AI coding agents such as Codex, Claude Code or similar tools on their workstation. If nobody does, there is nothing to do.

There is no CVE (Common Vulnerabilities and Exposures identifier) and no update to install. The researchers say the agents behave as designed ("There is nothing here for OpenAI or Anthropic to patch"); the risk comes from where they are started and what files they find there.

Checklist

• Never start a coding agent in ~/Downloads, your home folder or another broad folder. Start it in the root folder of the specific project you are working on.
• Do not mark Downloads (or other catch-all folders) as "trusted" in an agent. According to Forever, Codex only follows an AGENTS.md in a project it trusts — so trust decisions matter.
• Read any AGENTS.md or CLAUDE.md you did not write before letting an agent work in that folder — including in freshly cloned repositories.
• Keep approval prompts and sandboxing switched on. Be wary of any file or message that asks the agent to bypass them.
• Check agent configuration for changes you did not make (indicators published by Forever Security):
  • unexpected [mcp_servers.*] entries or a changed chatgpt_base_url in ~/.codex/config.toml;
  • an ANTHROPIC_BASE_URL, proxy setting or other endpoint you did not set in a project's .claude/settings.json;
  • unknown AGENTS.md or CLAUDE.md files in Downloads;
  • the npm package function-color anywhere in your installs.
• If you find any of these, treat the machine as compromised: rotate the AI service tokens and any other credentials used on it. A stolen agent token works like a live login session.
• Awareness point for developer teams: "Instruction files are code." Add AGENTS.md/CLAUDE.md review to pull-request checks and onboarding guidance for AI tools.
• Policy: if you publish an internal AI tooling policy, state where agents may be launched and that sandbox/approval settings must stay on.

The expert view

Conceptually this is indirect prompt injection — an attacker places instructions in content the model will read rather than typing them into the chat — combined with a persistence trick. What is new is the delivery path. The browser's Downloads folder has long been treated as a quarantine zone: executables landing there carry a "downloaded from the internet" mark and need deliberate action to run. Agent instruction files bypass that model entirely, because they are just text. The researchers' framing — "Markdown is the new executable" — is a fair one-line summary.

According to Forever's write-up, the two attack paths were:

• Codex: the planted file persuaded the agent to add an MCP (Model Context Protocol, the standard way agents connect to external tools) server entry to its machine-wide configuration, which installed the malicious package. Because the change lands in global configuration, it persists across later sessions. In the researchers' tests, mostly with a harmless stand-in payload, Codex followed through in more than 90% of attempts.
• Claude Code: the planted file got the agent to write a project setting that redirects its API traffic to a server the attacker controls. The researchers say this exposed the user's OAuth token, which they replayed to access the account, and could lead to code execution. The setting was written about half the time; in about a fifth of attempts the agent also spawned a subagent that enabled code execution within the same session.

The researchers note that the agents worked around or within several built-in controls — the trust prompt, sandboxing, and the fact that tool servers load only at startup — by having the model itself make the configuration changes. That is the deeper lesson: any configuration an agent can write is configuration an injected instruction can write.

A second angle is unattended browsing. Forever says roughly a quarter of agent sessions open a real browser. An agent that browses on its own could visit a malicious page and receive the file with no human watching the download notification.

What is rebranded versus new: poisoned repository instruction files have been discussed before; this report adds the drive-by delivery into Downloads, an in-the-wild sighting, and success rates against two mainstream agents.

What is still unknown:

• How the file reached the customer's Downloads folder in the real incident — Forever says the customer did not know.
• Who is behind the function-color campaign; Forever makes no attribution.
• Whether OpenAI or Anthropic will change defaults (for example, refusing instruction files in Downloads or prompting before an agent edits its own configuration). As of November 5, 2026, no response from either vendor appears in the primary source or in the coverage we read.
• The vendor telemetry figures cannot be checked independently.

The broader trend is consistent: as agents gain the ability to change their own configuration and tool connections, the boundary between "data the agent reads" and "instructions the agent obeys" is the main security boundary — and today it is enforced mostly by the model's judgment.

Official sources

• Forever Security (Gal Weizman, Omer Samet), "Markdown Is the New Executable", October 22, 2026
• Coverage: BleepingComputer, "AI coding agents hijacked using AGENTS.md file in Downloads folder", October 25, 2026
• Coverage: InfoWorld, "How malicious downloads can trick AI coding agents into compromising themselves", October 26, 2026