A malicious AGENTS.md sitting in ~/Downloads is enough to turn a coding agent against its owner. Researchers at Forever Security found exactly that on a customer's machine: an instruction file, disguised as ordinary engineering notes, that led an agent to try installing a known-malicious npm package. If you start Codex, Claude Code or a similar agent from your Downloads folder, you are the target audience. The fix is a habit change: start agents from a project root, and treat stray instruction files like executables.
This is not a vulnerability in one product with a version to update to. It is a gap between two behaviours that each look reasonable alone.
| Question | Answer |
|---|---|
| Am I affected? | Only if you run a coding agent with its working directory set to a folder where an untrusted AGENTS.md or CLAUDE.md can land, mostly ~/Downloads. |
| Is there a fix? | No patch. Forever Security says there is nothing for OpenAI or Anthropic to patch; the mitigation is configuration and habit. |
| What was the payload? | An instruction to install the npm package function-color, a known-malicious package since removed by npm. |
| Which agents? | Reproduced on OpenAI Codex (over 90% of attempts in a VM); a related technique worked on Claude Code in about 50% of attempts. |
| Does data leave my machine? | In the Claude Code variant, possibly: redirected API traffic can expose the OAuth login token. |
| How do I check? | Look for instruction files you did not write and for function-color in your installs. Details below. |
What did Forever Security find?
According to Forever Security's write-up (Gal Weizman and Omer Samet, October 22, 2026) and BleepingComputer's coverage, the company's monitoring blocked a coding agent from installing function-color, a package from a malicious campaign that, per Forever, went unnoticed for about two years until it was publicly documented. What made the event unusual was the source of the instruction. It did not come from a dependency, a cloned repository or a web page the agent browsed. It came from a file in the customer's Downloads folder.
The researchers could not determine how the file got there. That is worth stating plainly: the initial delivery in the real incident is unknown. What they did establish is that the delivery is plausible, because of two properties that combine badly.
- Coding agents are built to read and follow instruction files in the folder they open.
- Websites can save files into
~/Downloadswithout a click or permission prompt in common browsers. BleepingComputer notes Chrome, Edge and Firefox use that folder by default and show a download notification; Brave prompts for approval.
Put together, a web page can drop an instruction file that a trusted local agent later carries out. The authors summarize it as "markdown is the new executable."
How does the attack chain work?
The mechanism, as the researchers describe it:
- Plant. A file named
AGENTS.md(the instruction-file convention Codex reads) orCLAUDE.md(Claude Code) lands in~/Downloads. It is written to look like routine documentation. The researchers note that files containing security-sounding warnings made Claude refuse, so the effective ones read like boring engineering notes. - Launch. The user starts an agent with the Downloads folder as its working directory. Forever's telemetry says this is common: about half of its customers run a coding agent in Downloads, and the article cites hundreds of customers running Claude Code, Codex and Cursor CLI from there, often to organize files or act on something just downloaded.
- Load. The agent automatically loads the instruction file as project context. It has no way to tell that this file was dropped by a web page rather than written by the owner.
- Act. The agent follows the instructions. In the real incident, that meant trying to install
function-color. In the Codex reproduction, the researchers used a harmless payload (BleepingComputer says it opened the calculator app) and report it ran in more than 90 percent of attempts in an isolated VM. - Persist. For Codex, the effect targeted the machine-wide configuration file, so it persisted across all projects, not just Downloads. The write-up lists five controls the attack had to get past (the trust gate, unreliable writes to configuration, startup-only server loading, the network sandbox and a handshake timeout) and treats each as a separate finding. We are not reproducing payload specifics here.
The Claude Code variant
Claude was harder to manipulate. The technique that worked redirected the agent's API traffic to an attacker-controlled server instead of installing a package. According to the researchers, that can expose the user's OAuth login token, enabling account takeover without any code execution on the machine. The same position lets a server answer with tool calls: code execution in the next session, and about a fifth of the time in the same session. The planted configuration write succeeded in about 50 percent of attempts.
That variant matters beyond Claude Code. Any harness that lets a project-level file change where requests go, or which servers it talks to, hands the file's author a powerful position. Beam has covered the same class before in Cursor MCP config poisoning.
Why is there nothing to patch?
Forever's argument is that neither agent malfunctions. The browser saved a file it was asked to save. The agent read an instruction file it is designed to read. The researchers compare it to phishing: the problem is the content and where it landed.
You can disagree about where responsibility should sit. Vendors could, for example, treat instruction files in well-known download locations as untrusted, or show a stronger trust prompt for a directory the user has never opened before. Codex does have a trust gate, which the researchers say they had to get past. But as of the write-up, the position is that defense falls on users, and OpenAI and Anthropic already recommend starting agents from the specific project root instead of a home directory or broad parent.
The wider pattern is familiar. In agentjacking via Sentry, the instruction rode in on a fake error report; in WhatsApp hidden chatbot instructions, it rode in on content that differs between what a human and an agent fetch. Here it rides in on the filesystem. The common thread: an agent reads text from a place the user did not review and treats it as a directive.
What this means if you run AI coding agents
Stop using Downloads as a working directory. Open a project folder, or a scratch folder you created, and copy files into it deliberately. This is the single highest-value change.
Start agents at the project root. Not your home directory, not ~/Documents, not a parent that contains many unrelated folders. Both OpenAI and Anthropic recommend it, and it limits which instruction files are even candidates for loading.
Look for instruction files you did not write. Search the places a download or clone can land:
ls -la ~/Downloads/AGENTS.md ~/Downloads/CLAUDE.md
find ~/Downloads ~/Desktop -maxdepth 3 \( -name AGENTS.md -o -name CLAUDE.md \) 2>/dev/null
Read anything you find before an agent does. The same applies to freshly cloned repositories: open their AGENTS.md and CLAUDE.md first.
Check for the indicator. The package function-color is the published indicator of compromise. In a project that an agent has touched:
npm ls function-color
If it shows up on a machine, the researchers advise treating that machine as potentially compromised.
Review agent configuration. Look for MCP server entries you did not add and for changed API endpoints or base URLs in your agent's configuration files (for Codex, the machine-wide config; for Claude Code, its settings files and any environment overrides). The Claude Code variant works by changing where traffic goes, so an unexpected endpoint is the sign to look for.
Keep approvals and sandboxes on. Be suspicious of anything asking you to bypass them, and test untrusted code in an isolated environment first.
Rotate if in doubt. A leaked OAuth token is an active session. If you suspect compromise, sign out and back in, revoke sessions where the provider allows it, and rotate API keys that were reachable from that machine.
What Beam can and cannot do here
Beam is local, on-device security and observability for coding agents, and some of its documented features apply to this attack. Some do not.
- Scan before you run.
beam scan AGENTS.mdchecks a local instruction file offline for risky patterns without executing it (see AI agent security for coding assistants for the idea; the command is in Beam's CLI documentation). No collector or account is needed. - Deny risky actions. With an active workspace policy, Beam's hooks for Claude Code and Codex can return a deny before a risky command such as a suspicious install runs. See stopping Codex dangerous commands and stopping Claude Code dangerous commands.
- Keep a record. Beam captures what the agent did locally, with credential redaction before storage, so you can see afterwards whether an install or config write happened.
The limits are real. The scan is heuristic pattern matching, not semantic analysis, and a file written to read like plain documentation, which is exactly what the researchers describe, may not match anything. A clean scan is evidence, not proof. The deny is hook-based, not a kernel sandbox; it covers Claude Code and Codex PreToolUse, other agents get a note rather than a block, and a missing or expired cached policy does not enforce workspace rules. And an observe-mode setup records and flags but does not block. Moving the agent out of Downloads beats every tool-based control here.
Related reading
- AI agent security for coding assistants
- Agentjacking: MCP and Sentry prompt injection
- WhatsApp hidden chatbot instructions
- Cursor MCP config poisoning
- October 2026 attacks timeline
- Sources: Forever Security, BleepingComputer
Frequently asked questions
What is the malicious AGENTS.md attack?
It is an attack where a file named AGENTS.md (or CLAUDE.md) is planted in a folder, and a coding agent started in that folder reads it as trusted instructions. Forever Security found one in a customer's ~/Downloads folder that pushed an agent to install the malicious npm package function-color.
Is there a patch for this?
No. The researchers argue there is nothing for OpenAI or Anthropic to patch, because the agents behave as designed: they read instruction files from the working directory. The defense is where you start the agent and what files you let it follow.
Which agents were tested?
Forever Security reproduced the attack against OpenAI Codex, where the malware ran in more than 90 percent of attempts in an isolated VM, and demonstrated a related technique against Claude Code with about a 50 percent success rate for the configuration write.
How do I check whether I was affected?
Look for AGENTS.md or CLAUDE.md files you did not write, especially in ~/Downloads, check your installs for the npm package function-color, and review agent config files for unexpected MCP servers or changed API endpoints. If anything looks wrong, rotate credentials.
Can Beam block this?
Beam can scan an instruction file offline with beam scan before you run an agent on it, and with a workspace policy its Claude Code and Codex hooks can deny risky actions. The scan is heuristic and the deny is hook-based, so neither is a guarantee.
Details reflect the Forever Security write-up dated October 22, 2026 and press coverage on October 25, 2026. Success rates come from the researchers' own tests, and the delivery method in the real incident is unconfirmed; we will update this post if that changes.