# The AGENTS.md Downloads folder attack on Codex and Claude Code explained: how instruction files load, which guardrails apply, and how to check your machine > Source: > Published: 2026-10-26 14:15:51+00:00 # The AGENTS.md Downloads folder attack on Codex and Claude Code explained: how instruction files load, which guardrails apply, and how to check your machine On October 22, 2026, Forever Security reported a malicious AGENTS.md in a customer's Downloads folder and showed it could get OpenAI's Codex to install malware and Claude Code to leak its login token. This page maps the attack onto each agent's documented loading rules and guardrails, and gives the commands to check a machine. **This explains reporting by** [Gal Weizman and Omer Samet, "Markdown Is the New Executable" (Forever Security, October 22, 2026)](https://forever.security/blog/hijacking-ai-agents-via-downloads-folder). Read the original first: [https://forever.security/blog/hijacking-ai-agents-via-downloads-folder](https://forever.security/blog/hijacking-ai-agents-via-downloads-folder) ## In one minute - Forever Security found a planted AGENTS.md in a customer's ~/Downloads and stopped a coding agent from installing a malicious npm package, function-color. Nobody knows how the file got there. - In a sealed test machine, the real attacker file got OpenAI's Codex to add an MCP server to its machine-wide config and install the malware in more than 90% of attempts. - A planted CLAUDE.md got Claude Code to write a project settings file pointing ANTHROPIC_BASE_URL at the researchers' server about half the time. That leaked the OAuth token; same-session code execution happened about a fifth of the time. - Both agents load instruction files from the folder you start them in. Claude Code also reads AGENTS.md when no CLAUDE.md exists, so one file in Downloads can reach both tools. - Forever says there is nothing for OpenAI or Anthropic to patch. The fix is where you start agents: never in Downloads, and read any instruction file you did not write. ## What Forever found Forever Security sells monitoring for AI agents. On October 22, 2026, researchers Gal Weizman and Omer Samet wrote that their product stopped a coding agent, mid-session on a customer's machine, from installing an npm package called function-color. The instruction to install it came from an AGENTS.md file sitting in the customer's ~/Downloads folder, written to look like ordinary engineering notes. - Nobody knows how the file reached that folder. Forever says "nobody knew how it got there". - function-color belongs to a malicious npm campaign that Checkmarx documented, and Forever says npm has since removed it. Forever's advice: if it appears in a machine's installs, treat that machine as compromised. - Forever then tested the real attacker file against OpenAI's Codex inside an isolated virtual machine, and wrote a Claude Code version with a harmless stand-in payload. BleepingComputer covered the research on October 25 and reported no patch or formal response from either vendor. Forever's own position is that "there is nothing here for OpenAI or Anthropic to patch", because both agents did what they were built to do. ## Why the Downloads folder Two facts meet in ~/Downloads. - The web can write there. Forever argues a web page can save a file into Downloads with no click or permission, and choose its name and contents. BleepingComputer found that Chrome, Edge and Firefox save downloads there by default without asking where, while Brave asks the user to approve each download. - People start agents there. Forever says about half of its customers run a coding agent inside Downloads, usually to sort files or act on something they just downloaded. BleepingComputer quotes Forever's internal numbers as more than 1,300 Claude Code sessions started from that folder. An instruction file is not a program, so nothing about it looks dangerous to a browser or an antivirus scan. It only becomes dangerous when an agent starts in that folder and reads it as orders. ## How each agent finds its instructions The two agents load these files differently, and the difference decides who is exposed. Both rules below come from each vendor's own documentation. Codex builds its instruction chain once, at startup. It reads ~/.codex/AGENTS.md (or AGENTS.override.md) for global rules. Then it starts at the project root, usually the Git root, and walks down to the current folder, taking at most one file per folder. If it cannot find a project root, it checks only the current folder. The combined size is capped by project_doc_max_bytes, 32 KiB by default. Forever's attacker file was 13 KB, well under the cap. Claude Code loads CLAUDE.md and CLAUDE.local.md from the current folder and every folder above it, ordered from the filesystem root down, so the file closest to where you started is read last. Since version 2.1.277 it also reads AGENTS.md by default when there is no CLAUDE.md in the current folder or any folder above it. Put those together: - Start either agent in ~/Downloads and a planted file there is read at startup. - Start Claude Code in a subfolder of Downloads, such as an unzipped archive, and it still reads ~/Downloads/AGENTS.md as a parent folder, unless a CLAUDE.md sits somewhere on that path. - Start Codex inside a Git clone that lives in Downloads and it begins at the clone's root, so a file one level up in Downloads is not part of its chain. - A single AGENTS.md now reaches both tools. Forever tested CLAUDE.md for Claude Code, but by the documented rule an AGENTS.md alone would load too in a folder with no CLAUDE.md. That last point is our reading of the docs, not something Forever tested. Anthropic's memory documentation is blunt about what these files are: Claude treats them "as context, not enforced configuration". To block an action no matter what an instruction file says, it points to a PreToolUse hook. ## The Codex chain, step by step Forever describes the attacker file's path to code execution in Codex: - The AGENTS.md told Codex to add an MCP server entry to ~/.codex/config.toml. That is Codex's machine-wide config, so the change affects every later session, not just the one in Downloads. - The new entry ran an npm install of function-color through launchctl, the macOS service launcher. - The payload worked around a trust gate, an unreliable write, servers that load only at startup, a handshake timeout and the network sandbox. For the sandbox, Forever says the model wrote the --dangerously-bypass-approvals-and-sandbox flag itself. Codex ran the malware in "more than 90%" of attempts. OpenAI's documented defaults should slow this down. Folders that are not under version control start read-only, writes are limited to the active workspace, Codex asks before editing files outside the workspace or using the network, and Codex may stay read-only until you trust the folder. A Downloads folder is usually not a Git repository. Forever does not say which approvals or trust settings its test machine used, so it is not clear how many of those prompts a real user would have had to accept. ## The Claude Code chain, step by step The Claude Code version used a CLAUDE.md that told Claude to write .claude/settings.json in the project with ANTHROPIC_BASE_URL set to a server Forever controlled, on a domain it owned with a valid certificate. - Claude wrote the file "about half the time". - With API traffic rerouted, the OAuth token went to Forever's server, which Forever calls "account takeover, no code run". - The server could also answer as the model. Forever describes it returning a Bash tool call with dangerouslyDisableSandbox set to true. Code ran in the same session "about a fifth of the time", when Claude started a subagent that opened a fresh connection. Anthropic's documentation explains both why this is possible and where it should be caught: - Claude Code watches its settings files and reloads them when they change. It loads a project .claude/settings.json created mid-session, even when the .claude folder is created in the same session. That is how a settings file written by the agent can take effect before you restart. - .claude is a protected path. In the default Manual mode and in acceptEdits mode, every write to it prompts you. Auto mode routes it to a classifier, dontAsk denies it, and bypassPermissions allows it. An allow rule cannot pre-approve it. - Most env values in a project's .claude/settings.json wait until you accept the workspace trust dialog for that folder. In a claude -p or SDK run, which never shows the dialog, they are used. Forever does not say which permission mode or trust state its tests ran in. A user who clicks yes on the settings write, or who runs in bypassPermissions mode, gets the result Forever describes. ## Check a machine These commands look for the files and changes Forever names. They read only; none of them change anything. ``` # Instruction files where agents should never start find ~/Downloads ~/Desktop -maxdepth 3 \( -iname 'AGENTS.md' -o -iname 'AGENTS.override.md' -o -iname 'CLAUDE.md' -o -iname 'CLAUDE.local.md' \) -print # Codex: MCP servers and a changed base URL in the machine-wide config grep -nE '^\[mcp_servers|chatgpt_base_url' ~/.codex/config.toml # Claude Code: endpoints in user settings and in any project settings under Downloads grep -rnE 'ANTHROPIC_BASE_URL|HTTPS?_PROXY' ~/.claude/settings.json ~/Downloads/.claude 2>/dev/null # The npm package Forever caught npm ls -g --depth=0 2>/dev/null | grep -i function-color ``` An [mcp_servers] block you did not add, a base URL you did not set, or function-color anywhere means: stop using that machine for work, rotate every credential the agent could reach, and assume the agent's token leaked. Forever gives the same advice. ## Harden the setup - Start agents only in the root of the project you mean to work on. Never in ~/Downloads, and not in your home folder or a broad parent folder. - Before you start an agent in a folder you did not create, list it for AGENTS.md, AGENTS.override.md, CLAUDE.md and CLAUDE.local.md, and read them. - Keep approvals and sandboxes on. Treat --dangerously-bypass-approvals-and-sandbox in Codex and bypassPermissions in Claude Code as VM-only settings, and be suspicious of any instruction that asks the agent to turn them off. - In Claude Code, a PreToolUse hook can block writes to settings files or calls to unknown hosts regardless of what an instruction file says. Anthropic's hooks guide has a script for blocking edits to protected files. - In Codex, a project entry with trust_level set to "untrusted" makes commands ask for approval unless an execution-policy rule allows them. ## Who is affected | Case | Status | |---|---| | People who start Codex or Claude Code in ~/Downloads | Directly exposed. Any instruction file a web page drops there is read at startup. | | Claude Code sessions started in a subfolder of Downloads (an unzipped download, for example) | Exposed by the documented parent-folder rule, unless a CLAUDE.md sits on the path. Not separately tested by Forever. | | Codex sessions started inside a Git clone stored in Downloads | Codex starts its chain at the clone's root, so a file one level up in Downloads is not read. A file inside the clone still is. | | Agents started in a project folder you created | Not exposed by this route, which depends on the web writing into the start folder. | ## What to do - Run the four check commands above on every machine where you use a coding agent. - Stop starting agents in ~/Downloads, ~/Desktop or your home folder. Make the project root the only start point. - Read every AGENTS.md or CLAUDE.md you did not write before starting an agent beside it. - Keep Codex approvals and Claude Code's Manual or acceptEdits mode on for everyday work; save bypass modes for a VM. - If you find function-color, an unknown MCP server or a base URL you did not set, rotate credentials and treat the machine as compromised. ## What is still unknown - How the malicious AGENTS.md reached the customer's Downloads folder. Forever does not know. - Which Codex approval and trust settings, and which Claude Code permission mode, Forever's tests used. That decides how many prompts a real user would have had to accept. - The success rates are Forever's own figures from its own tests, and BleepingComputer's summary of the Claude Code rate differs from the post. This page uses the post's numbers. - Whether an AGENTS.md alone, with no CLAUDE.md, drives Claude Code the same way. The loading rule says it would be read; Forever tested CLAUDE.md. - No statement from OpenAI or Anthropic about this research had been published as of October 26. ## Sources [AI News Report](https://theainewsreport.com/)ยท every headline, every morning.