← All incidents

Forever Security says a planted AGENTS.md in a customer's Downloads folder tried to make Codex install the malicious npm package function-color

Research · OpenAI Codex and Claude Code (per Forever Security) · MEDIUM

Summary

Forever Security, a company that monitors AI agents, says it stopped a coding agent on a customer's computer from installing function-color, which it calls a known malicious npm package. Forever Security says the instruction came from an AGENTS.md file in the customer's ~/Downloads folder, which BleepingComputer reports was also the agent's working directory, and that nobody knew how the file got there. Its researchers, Gal Weizman and Omer Samet, then built a proof-of-concept web page that drops an AGENTS.md into Downloads. BleepingComputer tested it: "When BleepingComputer verified the PoC page, it downloaded an AGENTS.md file containing harmless content". In its own tests, Forever Security reports that Codex ran the malware "in more than 90% of attempts" and that Claude Code followed a crafted CLAUDE.md "about 50% of the time". The customer case and these rates come from Forever Security and have not been independently verified. Forever Security says "There is nothing here for OpenAI or Anthropic to patch." None of the three news reports we cite includes a comment from OpenAI or Anthropic, and we found no statement from either company as of Oct 26, 2026.

Severity

Timeline

1. Oct 22, 2026
   Forever Security publishes "Markdown Is the New Executable", by Gal Weizman and Omer Samet.
2. Oct 25, 2026
   BleepingComputer reports the research and says it loaded Forever Security's proof-of-concept page, which downloaded an AGENTS.md with harmless content.
3. Oct 26, 2026
   The Hacker News and Help Net Security report the research.

How it happened

Coding agents load instruction files such as AGENTS.md (Codex) and CLAUDE.md (Claude Code) from the folder they start in and follow them. Forever Security's point is that ~/Downloads is a folder a website can write to: its report says "a web page can download a file named AGENTS.md into your Downloads folder, silently." BleepingComputer says Chrome, Edge and Firefox save downloads to ~/Downloads by default without asking for a location, though they show a download notification, while Brave asked the user to approve the download in its tests. Forever Security says the file it found, which Help Net Security says runs to 13 KB, was disguised as engineering guidelines. Per The Hacker News, it told Codex to register a server in ~/.codex/config.toml and run a command that installed function-color. Because that file is Codex's machine-wide configuration, the server would load in later Codex sessions in any folder, Forever Security says. On method, Help Net Security reports that most of Forever Security's testing used a harmless stand-in that opens a calculator and that the real malicious package was run once inside an isolated virtual machine; BleepingComputer gives the Codex figure as a 90% success rate with the calculator payload. For Claude Code, Forever Security wrote its own CLAUDE.md, inspired by the attacker's file, asking Claude to write an ANTHROPIC_BASE_URL into a project settings file so its API traffic goes to a server Forever Security controlled (The Hacker News). Claude Code asks a person to approve that kind of change, and Forever Security says the write went through about half the time. That leaks the user's login token, which the researchers replayed to take over the account, and Help Net Security reports they got code running in the same session in about a fifth of tests. BleepingComputer words the roughly 50% figure as tool calls that executed code. The Hacker News says function-color belongs to a malware campaign that CloudSEK and Checkmarx researchers documented and named MALFEX, in which it pulls in a downloader called function-flag that fetches and runs a Windows payload; Help Net Security says, per Forever Security, that npm has removed the package. Forever Security says about half of its customers run a coding agent in their Downloads folder. BleepingComputer notes that OpenAI and Anthropic both recommend starting their coding agents in the project directory they are meant to work on.

How to check your app

• Don't start Codex, Claude Code or any other coding agent in ~/Downloads. BleepingComputer, citing OpenAI's and Anthropic's guidance, says to start agents in the root of the project they should work on.
• Look in your Downloads folder for AGENTS.md or CLAUDE.md files you didn't put there, and read any unfamiliar instruction file before letting an agent work in that folder, including in a repository you just cloned.
• Check ~/.codex/config.toml for a server block or changed base URL you didn't add, and project .claude/settings.json files for an ANTHROPIC_BASE_URL or other API endpoint you didn't set.
• Check whether function-color was ever installed on the machine. Forever Security says a computer where it was installed should be treated as compromised.
• Keep approval prompts and sandboxes on, and be wary of any instruction telling an agent to switch them off.
• If you find a planted file, assume the agent's login token leaked and rotate it, Forever Security advises.

Sources

• Forever Security (Gal Weizman, Omer Samet): Markdown Is the New Executable: Attackers Are Dropping Agent Instructions Into Your Downloads Folder From the Web (Oct 22, 2026). Primary source
• BleepingComputer (Bill Toulas): AI coding agents hijacked using AGENTS.md file in Downloads folder (Oct 25, 2026)
• The Hacker News (Swati Khandelwal): Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware (Oct 26, 2026)
• Help Net Security (Sinisa Markovic): AI coding agents fall for malicious instructions planted in the Downloads folder (Oct 26, 2026)

Corrections and updates

None. Re-checked against every source on Oct 26, 2026.