Can a Text File in Your Downloads Hijack Codex or Claude Code?

A plain Markdown file sitting in a Downloads folder just ordered an AI coding agent to install malware on a real customer's machine. Security startup Forever says it caught the attack live, then showed the same trick works on OpenAI's Codex and Anthropic's Claude Code.

Here's what you need to know:

• Forever found a malicious AGENTS.md in a customer's ~/Downloads folder, disguised as ordinary engineering notes, and blocked the agent mid-session.

• Replaying the real file in an isolated VM, Codex ran the attacker's package in more than 90% of attempts.

• The payload rewrites ~/.codex/config.toml, so the attacker's server loads in every future Codex session on the machine.

• A crafted CLAUDE.md rerouted Claude Code's API traffic and leaked its OAuth token in about half of Forever's tests.

• The package it tried to install, function-color, belongs to the MALFEX npm malware campaign.

How a planted AGENTS.md turns Codex into the attacker's installer.

What Happened

In an October 22 post, Forever Security's write-up "Markdown Is the New Executable" describes stopping a coding agent from installing function-color, a known malicious npm package. The odd part was where the order came from: not a dependency or a repo, but an AGENTS.md file in the customer's Downloads folder.

Coding agents read AGENTS.md (or CLAUDE.md) on startup and follow it, because it's meant to hold project instructions. Forever's point is that ~/Downloads is the one folder a website can write to on its own, and the company says that, depending on the browser, a page can drop a file there with no click. Forever doesn't know how this particular file arrived, as Mashable's report on the research notes.

The real file is a long, bland "Engineering Work Guidelines" document, about 13 KB, with the attack tucked into a "Local developer environment" section near the end. It tells Codex to register a "project-tools" MCP server in ~/.codex/config.toml, then launch a child codex exec with --dangerously-bypass-approvals-and-sandbox to "confirm" the server loads. That server entry hands an npm install function-color to macOS's launchctl, outside Codex's control.

Forever says a short, obvious "install this package" request gets refused, which is why the attacker padded the payload with pages of normal-looking guidance. Codex only obeys AGENTS.md in a trusted folder, but once you've worked in Downloads, it qualifies.

The team then asked whether this was just a Codex quirk. Claude Code was "much harder to fool," Forever says, so it crafted its own CLAUDE.md that asks Claude to write an ANTHROPIC_BASE_URL into .claude/settings.json, pointing it at a server Forever controlled. That worked about 50% of the time, leaked the OAuth token, and let the fake "model" send back tool calls with the sandbox switched off. Unlike the Codex case, this variant was a lab demonstration, not something seen in the wild.

Why It Matters

Forever's own telemetry says about half of its customers run a coding agent inside their Downloads folder, and roughly a quarter of agent sessions open a real browser. That second number matters: if an agent is browsing for you, it can fetch the very file that hijacks it, with nobody watching.

The malware link is real, too. Checkmarx's analysis of the MALFEX npm campaign describes function-color as a wrapper that pulls in function-flag, a Windows downloader that accounts for 37,419 of the campaign's 40,767 recorded downloads. The OSV malicious-package advisory for function-color, published October 7, says any machine that installed it should be treated as fully compromised.

The uncomfortable part: Forever argues there's nothing for OpenAI or Anthropic to patch. An agent that follows the instruction file in its folder is doing what it was built to do. That echoes NVIDIA's AI Red Team research on AGENTS.md injection from April, where a poisoned dependency wrote an AGENTS.md that made Codex hide a five-minute sleep in a pull request. OpenAI told NVIDIA that attack didn't significantly raise risk beyond an already-compromised dependency. The Downloads route doesn't need a compromised dependency at all.

It's the same lesson we keep hitting in AI tooling: after the OpenCode console breach that exposed AI API keys, the weak spot again isn't the model, it's what the agent is allowed to touch.

What It Means for Developers

You don't need a new tool to cut this risk today. Forever's own checklist is a solid starting point:

• Never start an agent in ~/Downloads. Treat it as hostile ground for Codex, Claude Code or any agent that reads instruction files.

• Read any AGENTS.md or CLAUDE.md you didn't write, including in freshly cloned repos, before an agent sees it.

• Audit agent configs. Look for unexpected [mcp_servers.*] blocks or a changed chatgpt_base_url in ~/.codex/config.toml, and any ANTHROPIC_BASE_URL or proxy you didn't set in .claude/settings.json.

• Keep approvals and sandboxes on, and treat any instruction telling an agent to bypass them as a red flag.

• Rotate tokens if you find a planted file. Deleting the file won't undo config changes the agent already made.

• Block function-color and function-flag at your registry proxy and search lockfiles for them, as Checkmarx recommends.

If your team already adds supply-chain guardrails like Composer 2.11's new cooldown against PHP supply chain attacks, extend that thinking to agent instruction files: they now behave like executable config.

The Claude Code variant: one config line reroutes the API and leaks the token.

What's Next

Forever's post doesn't include a response from OpenAI or Anthropic, and the company itself says the vector "stays open" because nothing in either agent is technically broken. The real question is whether agent makers start treating instruction files from untrusted locations differently, for example by flagging files in Downloads or asking before an agent edits its own global config.

Some details are still unclear. Forever hasn't said how the file reached its customer's machine, and Checkmarx's analysis says the function-flag payload targets Windows, while the planted launcher uses macOS's launchctl.

FAQ

Can a website really put AGENTS.md in my Downloads folder?

Forever says yes: depending on browser settings, a page can save a file to Downloads without a click and choose its name and contents. Forever doesn't know how its customer's file got there.

Is this a bug OpenAI or Anthropic can patch?

Forever says no, because both agents are following their instruction files as designed. The risk comes from running them in a folder the web can write to.

How do I check if my coding agent was hijacked?

Look for unfamiliar MCP servers or API endpoints in ~/.codex/config.toml and .claude/settings.json, and check installs for function-color. If you find anything, treat the machine as compromised and rotate tokens.

Sources

• Markdown Is the New Executable: Attackers Are Dropping Agent Instructions Into Your Downloads Folder From the Web, Forever Security

• Hackers find a way to turn users' own AI agents and Downloads folders against them, Mashable

• MALFEX npm Malware Campaign: Three Payloads And An Adversary That Signs Their Work, Checkmarx

• MAL-2026-17647: Malicious code in function-color (npm), OSV

• Mitigating Indirect AGENTS.md Injection Attacks in Agentic Environments, NVIDIA Technical Blog

Follow TheTechLane

Keep learning AI, development, and modern developer technologies with TheTechLane. Learn • Build • Share Follow @thetechlanehq for more developer guides, tutorials, and practical technology content.