Claude Code and Codex obey a file any website can drop in your Downloads

A text file that a website saves to your Downloads folder can now give orders to the AI coding agent on your computer. Researchers at Forever Security found a planted AGENTS.md, the plain-text instructions file that tools like OpenAI’s Codex read when they start, on a customer’s machine, where it had told the agent to install a known piece of malware. If you have ever opened Claude Code or Codex in Downloads to tidy it up or to work on a file you just fetched, you have given that folder the same trust as one of your own projects.

The agent did nothing wrong by its own rules. AGENTS.md and its Claude equivalent, CLAUDE.md, exist so a project can tell an agent which tools to use and how to run its tests, and the agent is built to follow them. The researchers’ point is that Downloads is the one folder the web can fill on its own. “There is nothing here for OpenAI or Anthropic to patch,” they write. “An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do.”

The real file was a 13 KB document titled as engineering guidelines, with the attack buried near the end and written in the calm voice of a setup note. It told Codex to add a “project tools” server to its configuration and install an npm package called function-color, which the researchers describe as malware from a campaign that went unnoticed for roughly two years. Forever’s software blocked the install before any code ran. In the team’s tests, mostly with a harmless stand-in that only opened the calculator, Codex carried out the file’s orders in more than 90 percent of attempts, and the real package also ran once inside an isolated virtual machine. The change lands in Codex’s machine-wide settings file, so every later Codex session loads the attacker’s server, in any folder.

Claude Code was harder to fool. The team wrote its own CLAUDE.md that persuades Claude to point its API traffic at a server the attacker controls, dressed up as a company gateway. That one setting hands over Claude’s login token, which the researchers replayed against Anthropic’s real API to act as the victim, and lets the fake server answer as if it were the model, sending back commands with the sandbox switched off. Claude asks a human to approve a settings change like this and often refuses, but the write still went through about half the time.

Getting the file onto a machine takes less than you would think. Chrome, Edge and Firefox save downloads to that folder without asking where by default, and a page can choose the file’s name and contents. BleepingComputer, which reported the findings, visited the researchers’ proof-of-concept page and watched it drop a harmless AGENTS.md. Brave asked for permission first. Forever researcher Gal Weizman told the outlet that hundreds of the company’s customers run Claude Code, Codex or Cursor’s command-line agent from Downloads, and that Claude Code alone had launched more than 1,300 sessions there.

The research leaves gaps. Forever could not establish how the malicious file reached its customer’s computer, and the attack still needs someone to start an agent in that folder afterwards. Chrome, Edge and Firefox do show a download notice, which an attentive user may spot. The real payload was written for macOS. Forever also sells monitoring software for AI agents, so the company has a commercial interest in the risk it describes, and the report carries no response from OpenAI or Anthropic. The tools involved are sold worldwide, so the exposure is the same in every market where developers use them.

The defence is mostly habit. Never start a coding agent in Downloads, and run it from the folder of the project it should work on, which is what OpenAI and Anthropic already recommend. Read any AGENTS.md or CLAUDE.md you did not write before an agent sees it, and keep approval prompts and sandboxes on. In Codex’s settings file, look for a server entry you did not add. In a project’s Claude settings, look for an API address you never set. If one appears, treat the login token as stolen and revoke it, and treat any machine that installed function-color, which npm has since pulled, as compromised.

Forever published its report on October 22, and BleepingComputer’s coverage followed on October 25. The researchers say any agent that reads an instructions file and can rewrite its own configuration can be steered the same way, which makes Codex and Claude Code the first two names on a longer list. A browser download used to be harmless until someone opened it. Now the file opens itself the moment an agent starts reading the folder.

Tags: OpenAI, Anthropic, Claude Code, AI coding agents, AGENTS.md, Forever Security