Markdown in Downloads: a planted AGENTS.md hijacks Codex and Claude Code

01What happened

Forever Security published this research on October 22, 2026, after stopping a coding agent on a customer's machine that was trying to install the malicious npm package function-color. Gal Weizman and Omer Samet traced the attempt to an AGENTS.md file sitting in the customer's Downloads folder, which was also the folder the agent ran in. How that file reached the machine was never established.

02How it works

Coding agents treat the folder they start in as trusted and read its AGENTS.md or CLAUDE.md as instructions, while a web page can write a file into Downloads without a click. In the Codex tests the planted file added an MCP server entry to the machine-wide ~/.codex/config.toml and installed function-color. The Claude Code variant wrote ANTHROPIC_BASE_URL into .claude/settings.json, pointing the agent at a server the researchers owned on a domain with a valid certificate, which then captured the OAuth token and could answer in place of the model with a Bash tool call that set dangerouslyDisableSandbox to true.

03Who is affected

OpenAI Codex and Claude Code are the two agents Forever tested, on any machine where a developer starts one of them in the Downloads folder. Forever says about half of its customers do exactly that, and that roughly a quarter of agent sessions open a real browser. The payload failed every time in a folder full of security notes.

04What to do

Do not start coding agents in the Downloads folder, and read any AGENTS.md or CLAUDE.md you did not write before an agent reaches it. Check ~/.codex/config.toml for MCP server blocks or a changed base URL you did not add, and a project's .claude/settings.json for an ANTHROPIC_BASE_URL or proxy you did not set. Rotate credentials if either looks wrong, because a stolen token is a live session.

Questions people ask

Is Claude Code patched against the Downloads folder AGENTS.md attack?

No patch exists for Claude Code against the Downloads folder attack. Forever Security argues there is nothing for Anthropic or OpenAI to fix, because an agent that reads the instruction file in its own working directory is doing what it was designed to do. Defence rests on where a developer starts the agent and on reviewing unfamiliar instruction files first.

How do I check whether my coding agent was hijacked this way?

Open ~/.codex/config.toml and look for MCP server blocks or a changed base URL you did not add, Forever Security advises, then open the project's .claude/settings.json and look for an ANTHROPIC_BASE_URL or proxy you did not set. Finding the npm package function-color among your installs should be treated as a compromised machine.

What happens if an attacker captures Claude Code's OAuth token?

Capturing the OAuth token gave Forever Security's researchers the victim's session. They replayed a captured token against the real API and were served as the victim, which they describe as account takeover with no code run on the machine. Rotating credentials is the response, because a stolen token stays live until it is revoked.

Sources 2 links, all fetched

1. 1forever.securityForever Security
2. 2checkmarx.comCheckmarx On MALFEX