Malicious AGENTS.md and CLAUDE.md files: how a Downloads folder can hijack AI coding agents

A planted instruction file in Downloads tried to make an AI coding agent install npm malware. What happened, what the research showed, and how to defend.

What happened

On October 22, 2026, the security firm Forever Security published “Markdown Is the New Executable”, by Gal Weizman and Omer Samet. The post describes a real incident on a customer’s machine. An AI coding agent was working in the user’s ~/Downloads folder, and an AGENTS.md file in that folder told it to install function-color, a malicious npm package. Forever stopped the agent before the package was installed and before any malicious code ran.

Nobody knows how the file got into the Downloads folder. Forever says it could not determine this, and news coverage by BleepingComputer and The Hacker News repeats that point. Forever then built lab demonstrations to show how a web page could plant such a file and what an agent would do with it.

The package itself is not new. Checkmarx and CloudSEK link function-color to the MALFEX npm campaign. The package is a thin wrapper that pulls in function-flag. That package’s install script downloads and runs a further payload from a remote server. The campaign targets Windows, and Checkmarx reports that its operator has been active since August 2023. When we checked the npm registry on October 29, 2026, function-color, function-flag and cdn-img-fetch had all been replaced by npm’s 0.0.1-security placeholder.

Why a Markdown file can steer an agent

Forever’s argument rests on two ordinary behaviors that become dangerous together.

1. Agents load instruction files automatically. Coding agents read project instruction files at startup and treat them as guidance from the user. Codex reads AGENTS.md from the project root down to the current folder. If there is no project root, it reads only the current folder. Claude Code loads CLAUDE.md from the folder it starts in and from every folder above it. It reads AGENTS.md instead when no CLAUDE.md is present.
2. The web can write to Downloads. BleepingComputer reports that Chrome, Edge and Firefox save files to Downloads by default without asking where to put them. A page can choose the file’s name and contents. A Markdown file is not a program, so the operating system’s checks for downloaded executables do not treat it as dangerous.

Together, these mean a web page can drop a file that an agent will later read as instructions. The agent does not have to be “tricked” in the usual sense: it is doing what it was built to do. Forever also points out that some agents browse the web on their own. In that case no person may see the download happen at all.

The same logic applies beyond Downloads. Any folder that untrusted content can reach is a candidate: a freshly cloned repository, an unpacked archive or a shared folder. With Claude Code, a project unpacked into a subfolder of Downloads also picks up a CLAUDE.md sitting in Downloads itself, because files in parent folders are loaded too.

What the research demonstrated

Forever tested two agents. Most runs used a harmless stand-in payload (opening the calculator). The real malicious package was run once, inside an isolated virtual machine.

OpenAI Codex

The researchers reused the real AGENTS.md from the customer’s machine. The file told Codex to add an MCP server entry to its machine-wide configuration, ~/.codex/config.toml. That entry ran a command at startup that installed the npm package. Because the configuration is global, the change persists into every later Codex session on the machine, not just the one that read the file. Forever reports that the attack needed several workarounds: a long, dull document style, a child session started with sandbox-bypass flags, and a launch method that avoided Codex’s startup timeout. Even so, Codex ran the payload in more than 90% of attempts.

Claude Code

For Claude Code, the researchers wrote their own CLAUDE.md, styled as setup notes for an internal API gateway. It asked Claude to write an ANTHROPIC_BASE_URL setting into the project’s .claude/settings.json, pointing API traffic at a server the researchers controlled. According to Forever, this leaks the session’s OAuth token. It also lets the attacker’s server pose as the model and send back tool calls, including shell commands with the sandbox disabled. Forever demonstrated token theft (replaying the token to act as the victim) and code execution on the next launch. They also showed a path that triggered the attack within the same session by starting a subagent.

This worked less reliably. Claude Code asks for approval before writing to settings files and often refused the suspicious change. Forever reports success about half the time, and about one in five attempts for the same-session subagent path.

What was not shown

• Forever did not establish how the real file reached the customer’s Downloads folder. The web-download route is a demonstrated possibility, not a confirmed cause.
• Only Codex and Claude Code were tested. Forever argues that other agents that load instruction files are exposed in the same way, but did not test them.
• The articles do not name specific tool versions, and they report no vendor statements. Forever’s position is that “there is nothing here for OpenAI or Anthropic to patch”: the agents are working as designed.

Why this matters

Instruction files are easy to overlook because they look like documentation. In practice they act like configuration, and through an agent with shell access they can act like code. Three points make the risk practical:

• Agents are often started in Downloads. People use agents to sort files or work with something they just downloaded. Forever told BleepingComputer that hundreds of its customers run coding agents from Downloads, with more than 1,300 Claude Code sessions started there.
• The impact outlives the session. A changed global config, a new MCP server or a redirected API endpoint keeps working after the original file is deleted.
• Credentials are the prize. A stolen agent session token is a working login. An attacker can use it without running any code on the machine.

Practical defenses

1. Choose where agents start

• Never start a coding agent in ~/Downloads, or in any folder that browsers, email or chat apps write into. Move or clone the work into a dedicated workspace folder first.
• Avoid starting agents in your home directory too. Start them in the specific project folder. BleepingComputer notes that OpenAI and Anthropic recommend the same.
• Consider setting your browser to ask where to save each download. It adds a click, but it stops silent downloads.

2. Look for instruction files you did not write

Search the places where untrusted files land, plus your home folder. On Linux and macOS:

find ~/Downloads ~/Desktop ~ -maxdepth 3 \( -name AGENTS.md -o -name AGENTS.override.md -o -name CLAUDE.md -o -name CLAUDE.local.md \) -print 2>/dev/null | sort -u

On Windows, in PowerShell:

Get-ChildItem $HOME\Downloads, $HOME\Desktop -Recurse -Depth 3 -Force -ErrorAction SilentlyContinue -Include AGENTS.md, AGENTS.override.md, CLAUDE.md, CLAUDE.local.md | Select-Object FullName, LastWriteTime

Read every file you find before an agent goes near it. Be very suspicious of instructions to install packages, add servers, change API endpoints or turn off approvals. Also check your personal instruction files, ~/.codex/AGENTS.md and ~/.claude/CLAUDE.md, because these apply to every session.

3. Check agent configuration for changes you did not make

Following Forever’s advice, look for unexpected MCP server blocks, a changed chatgpt_base_url, or an ANTHROPIC_BASE_URL or other API endpoint you did not set:

grep -nE '^\[mcp_servers|base_url' ~/.codex/config.toml
grep -nE 'BASE_URL|mcpServers' ~/.claude/settings.json .claude/settings.json .claude/settings.local.json .mcp.json 2>/dev/null

Teams that use Claude Code can enforce settings centrally with managed settings. They can also use ConfigChange hooks to audit or block settings changes during a session.

4. Keep the guardrails on

• Leave approval prompts and sandboxing enabled. Avoid flags that bypass them, such as Codex’s --dangerously-bypass-approvals-and-sandbox or Claude Code’s --dangerously-skip-permissions, outside a disposable environment.
• Read approval prompts for settings and config files carefully. In the Claude Code test, the approval step is what stopped the attack about half the time.
• Read Claude Code’s workspace trust dialog before accepting it for a new folder.
• Work with untrusted repositories and downloads inside a virtual machine or dev container, not on your main workstation.
• For npm, block the known MALFEX packages and consider ignore-scripts for installs you have not reviewed.

5. If you find a planted file

1. Do not start an agent in that folder. Keep a copy of the file for investigation, then remove it from the folder.
2. Check the agent configuration files listed above and remove anything you did not add.
3. Assume the agent’s session token may have leaked. Sign out and sign back in, and rotate any API keys the agent could reach.
4. Search lockfiles and node_modules folders for function-color and function-flag. If either was installed, treat the machine as compromised and follow your incident response process.

The bigger picture

Forever’s title is “Markdown Is the New Executable”. That is a useful way to think about any file an agent reads as instructions. Instruction files decide what an agent with shell access will do next, so they deserve the same care as scripts: know where they came from, review changes to them, and keep them out of folders that anyone on the internet can write to. The fixes here are mostly habits, not patches, and they cost little to adopt.

References

• Forever Security, “Markdown Is the New Executable” (October 22, 2026), the primary source
• BleepingComputer, “AI coding agents hijacked using AGENTS.md file in Downloads folder” (October 25, 2026)
• The Hacker News, “Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware” (October 26, 2026)
• Checkmarx, MALFEX npm malware campaign (October 5, 2026)
• CloudSEK, MALFEX malicious npm postinstall supply chain campaign
• OpenAI, Codex AGENTS.md documentation
• Anthropic, Claude Code memory (CLAUDE.md) documentation and Claude Code security documentation