Rogue AGENTS.md in the Downloads folder tried to make an AI coding agent install malware
A rogue AGENTS.md in a Downloads folder tried to make Codex install a malicious npm package. It was stopped before code ran, but lab tests often succeeded. There is no patch.
Translated from the German original with an AI language model, approved by me. Read the original
Security firm Forever Security found something on a customer's machine that most of us had only imagined in theory: a planted instructions file meant to make an AI coding agent install malware. The agent was stopped before any code ran. Since my first post, though, new details have come out that make this more serious.
What happened
AI coding agents like OpenAI Codex or Claude Code automatically read instructions files in their working directory, meaning the folder you start them in. For Codex that file is AGENTS.md, for Claude Code it's CLAUDE.md. These files usually hold project rules like "use pnpm" or "tests live in /test". The agent treats their contents as instructions to follow.
According to BleepingComputer, the customer's working directory was their Downloads folder. An AGENTS.md sat in it, disguised as ordinary engineering notes. It told the agent to install the npm package "function-color". npm is the package manager for JavaScript. Per The Hacker News, that package pulls in another one ("function-flag"), a downloader that fetches and runs a Windows payload. The file also told Codex to register a server in its global configuration, so the change would have affected sessions in completely different folders too.
How the file got there is still unknown. Forever Security showed that a web page can drop a file named AGENTS.md into the Downloads folder. Chrome, Edge and Firefox save there by default and only show a notification. BleepingComputer reproduced this proof of concept (a demonstration that the attack is feasible) with a harmless file. Whether a real attacker used this route has not been established.
New since the post: lab results and no patch
On the customer's machine it stayed an attempt. In the lab, things looked different:
- Codex: According to BleepingComputer, a harmless test payload (opening the calculator) worked in about 90 percent of attempts.
- Claude Code: A planted CLAUDE.md, framed as internal gateway setup, tried to redirect API traffic to a server controlled by the researchers. That would have exposed the login token and let the server impersonate the model and send back commands. It worked about half the time. Claude usually asks for approval before such changes and often refuses suspicious ones.
There won't be a patch. Forever Security itself says there is nothing for OpenAI or Anthropic to fix. The agent does exactly what it was built to do: follow the instructions in its working directory. Neither report includes a statement from the vendors. BleepingComputer notes both already recommend running agents from the project directory.
Why it matters
At its core this is prompt injection: outside text gets treated by the model as a command. What's new is the location. Not a booby-trapped repository, not a malicious web page in a chat, but a folder where every browser drops files without asking. And this isn't an edge case. According to BleepingComputer, hundreds of Forever Security customers launch agents like Claude Code, Codex or Cursor CLI from their Downloads folder, with more than 1,300 sessions from Claude Code alone.
I see this as a wake-up call. Instructions files look like documentation, but they act like a script running with the agent's permissions. And those are often the same as yours.
Who is affected
Anyone running AI coding agents locally, especially if they start them in their Downloads or home folder. So far, one stopped attempt at a single customer is confirmed. No damage is known.
What you should do
- Never start agents in your Downloads or home folder. Always use the root of the relevant project.
- Read unfamiliar AGENTS.md, CLAUDE.md and similar files before your agent does. That includes freshly cloned repositories.
- Check your configuration: for Codex, look for unknown server entries in config.toml. For Claude Code, look for an unexpected ANTHROPIC_BASE_URL or other API endpoints in settings.json.
- Keep approval prompts and sandboxing on. Be suspicious of any file that asks the agent to turn them off.
- Allow package installs only after approval. No auto-approve for npm, pip and the like.
- Rotate tokens if you find something. If you find a planted file, assume your login token has leaked.
- Test unfamiliar code in isolation, for example in a VM or container.
In short: treat instructions files like untrusted code. To your agent, that's exactly what they are.