# Markdown in Downloads: a planted AGENTS.md hijacks Codex and Claude Code

> Forever Security found a real AGENTS.md in a customer's Downloads folder that told a coding agent to install a malicious npm package.

- **Severity:** High: A working attack on a widely used AI product or ecosystem. A fix may exist. Patch or mitigate this week.
- **Category:** Attack, Supply chain
- **Published by:** Forever Security
- **Disclosed:** 2026-10-22
- **Affects:** OpenAI Codex, Claude Code
- **Research by:** Gal Weizman, Omer Samet
- **Primary source:** https://forever.security/blog/hijacking-ai-agents-via-downloads-folder
- **Page:** https://theinjection.dev/items/forever-agents-md-downloads-hijack/

A planted AGENTS.md file in a user's Downloads folder makes OpenAI Codex install malware, Forever Security reports, and a matching CLAUDE.md reroutes Claude Code's traffic to an attacker server that captures its OAuth token.

## What happened

Forever Security published this research on October 22, 2026, after stopping a coding agent on a customer's machine that was trying to install the malicious npm package function-color. Gal Weizman and Omer Samet traced the attempt to an AGENTS.md file sitting in the customer's Downloads folder, which was also the folder the agent ran in. How that file reached the machine was never established.

## How it works

Coding agents treat the folder they start in as trusted and read its AGENTS.md or CLAUDE.md as instructions, while a web page can write a file into Downloads without a click. In the Codex tests the planted file added an MCP server entry to the machine-wide ~/.codex/config.toml and installed function-color. The Claude Code variant wrote ANTHROPIC_BASE_URL into .claude/settings.json, pointing the agent at a server the researchers owned on a domain with a valid certificate, which then captured the OAuth token and could answer in place of the model with a Bash tool call that set dangerouslyDisableSandbox to true.

## Who is affected

OpenAI Codex and Claude Code are the two agents Forever tested, on any machine where a developer starts one of them in the Downloads folder. Forever says about half of its customers do exactly that, and that roughly a quarter of agent sessions open a real browser. The payload failed every time in a folder full of security notes.

## What to do

Do not start coding agents in the Downloads folder, and read any AGENTS.md or CLAUDE.md you did not write before an agent reaches it. Check ~/.codex/config.toml for MCP server blocks or a changed base URL you did not add, and a project's .claude/settings.json for an ANTHROPIC_BASE_URL or proxy you did not set. Rotate credentials if either looks wrong, because a stolen token is a live session.

## Quick facts

- **Affected:** OpenAI Codex, Claude Code
- **Attack type:** Agent instruction file planted in the Downloads folder
- **Codex result:** Malware ran in more than 90% of attempts
- **Claude Code result:** Config write accepted about 50% of the time, same-session execution about a fifth of the time
- **Indicator:** The npm package function-color among a machine's installs
- **Status:** No patch. Forever says the agents behaved as designed

## Questions

### Is Claude Code patched against the Downloads folder AGENTS.md attack?

No patch exists for Claude Code against the Downloads folder attack. Forever Security argues there is nothing for Anthropic or OpenAI to fix, because an agent that reads the instruction file in its own working directory is doing what it was designed to do. Defence rests on where a developer starts the agent and on reviewing unfamiliar instruction files first.

### How do I check whether my coding agent was hijacked this way?

Open ~/.codex/config.toml and look for MCP server blocks or a changed base URL you did not add, Forever Security advises, then open the project's .claude/settings.json and look for an ANTHROPIC_BASE_URL or proxy you did not set. Finding the npm package function-color among your installs should be treated as a compromised machine.

### What happens if an attacker captures Claude Code's OAuth token?

Capturing the OAuth token gave Forever Security's researchers the victim's session. They replayed a captured token against the real API and were served as the victim, which they describe as account takeover with no code run on the machine. Rotating credentials is the response, because a stolen token stays live until it is revoked.

## Sources

1. [Forever Security](https://forever.security/blog/hijacking-ai-agents-via-downloads-folder)
2. [Checkmarx On MALFEX](https://checkmarx.com/zero-post/malfex-npm-malware-campaign-three-payloads-and-an-adversary-that-signs-their-work/)