Planted AGENTS.md in Downloads Hijacks AI Coding Agents

What to do

1. Never start a coding agent in ~/Downloads, ~/Desktop or $HOME; cd into a specific project directory first.
2. Check ~/Downloads for stray instruction files (ls -la ~/Downloads/AGENTS.md ~/Downloads/CLAUDE.md) and delete any you did not create.
3. Inspect ~/.codex/config.toml for [mcp_servers.*] blocks or a chatgpt_base_url you did not add, and .claude/settings.json files for an ANTHROPIC_BASE_URL or proxy you did not set.
4. Keep approval prompts and sandboxing on, and treat any instruction file that asks an agent to bypass them as hostile.
5. Read unfamiliar AGENTS.md or CLAUDE.md files in new repositories before letting an agent act on them.
6. If function-color or function-flag was ever installed on a Windows machine, treat it as compromised and rotate credentials from a clean system.

How to check if you are affected or compromised

• Search for planted instruction files: find ~/Downloads ~/Desktop -maxdepth 2 -iname 'AGENTS*.md' -o -iname 'CLAUDE.md'
• Check for the malware packages: npm ls -g function-color function-flag, and search lockfiles and npm caches for either name.
• Review agent configs: grep -n -e mcp_servers -e base_url ~/.codex/config.toml, and grep -rn ANTHROPIC_BASE_URL in .claude/settings.json files.
• On Windows, look for the MALFEX host artifacts Checkmarx lists, such as %APPDATA%\node.exe and %APPDATA%\Microsoft\Windows\node_runtime_helper.exe.

What happened#

On October 22, 2026, the agent-security firm Forever Security described a malicious AGENTS.md it found in the ~/Downloads folder of a real customer's machine. The roughly 13 KB file looked like ordinary "Engineering Work Guidelines". A section near the end, written as routine local setup, told the agent to do three things: register an extra tool server in the machine-wide Codex config, have that config install an npm package, and start a child session with the approval and sandbox bypass flags. Forever found the file when its product blocked a coding agent from installing the known-malicious package function-color mid-session. The Hacker News reports that the agent was stopped before any code ran. How the file got onto the machine is unknown.

function-color is part of the MALFEX campaign that Checkmarx documented earlier this month. It is a wrapper that installs function-flag, whose postinstall script downloads and runs a Windows executable. Checkmarx said on September 29 that it was still installable with no advisory. Forever says it has since been removed from npm.

Who is affected#

Any coding agent that automatically reads instruction files from its working directory, when it is started in a folder an attacker can write to. Codex's documentation describes the behavior: it walks from the project root down to the working directory and loads the AGENTS.md it finds at each level. If it cannot find a project root, "it only checks the current directory." Start Codex in ~/Downloads and whatever AGENTS.md sits there becomes part of its instructions.

Forever reproduced the real file against OpenAI Codex in an isolated VM, and the malware ran in more than 90% of attempts. Because the edits went into ~/.codex/config.toml, they would affect every later Codex session on the machine. Against Claude Code, Forever used a separate, crafted CLAUDE.md. It got Claude Code to write a .claude/settings.json with an attacker-controlled ANTHROPIC_BASE_URL in about half of attempts, which exposed the session's OAuth token to that server. BleepingComputer notes that Cursor CLI was mentioned but not tested.

The habit is common. Forever's telemetry says about half of its customers run a coding agent in their Downloads folder, and BleepingComputer cites more than 1,300 Claude Code sessions launched from that location.

Do you really need to act?#

Only if your habits match. Two conditions both have to hold: an attacker gets a file into a folder you later point an agent at, and you then launch the agent there. Browsers save to ~/Downloads by default, so the first condition is easier than it sounds. Forever argues a web page could drop the file there, although it has not shown how this particular file arrived. Starting agents from your project directories breaks the chain.

There is no CVE and no patch. As Forever puts it, "There is nothing here for OpenAI or Anthropic to patch": the agents did what instruction files told them. That puts the defense on your side. Choose the working directory deliberately, keep approval prompts and sandboxing on, and read instruction files you did not write. This is a single observed case, not a reported mass campaign. It is still a real, in-the-wild example of instruction-file poisoning aimed at developer machines, carrying real npm malware.

What to do now#

1. Start agents only inside a specific project: cd ~/code/my-project && codex, never from ~/Downloads, ~/Desktop or ~.
2. Remove stray instruction files: ls -la ~/Downloads/AGENTS.md ~/Downloads/CLAUDE.md, and delete any you did not create.
3. Audit agent configs. Look in ~/.codex/config.toml for [mcp_servers.*] blocks or a chatgpt_base_url you did not add. Look in .claude/settings.json files for an ANTHROPIC_BASE_URL or proxy you did not set.
4. Keep approvals and sandboxing enabled. An instruction file that asks for bypass flags is a red flag in itself.
5. Read unfamiliar AGENTS.md and CLAUDE.md files in newly cloned repositories before letting an agent act on them.

How to tell if you were hit#

Search for planted files with find ~/Downloads ~/Desktop -maxdepth 2 \( -iname 'AGENTS*.md' -o -iname 'CLAUDE.md' \). Check for the packages with npm ls -g function-color function-flag and by searching lockfiles. Forever says any machine that installed function-color should be treated as compromised. Checkmarx lists Windows artifacts such as %APPDATA%\node.exe and %APPDATA%\Microsoft\Windows\node_runtime_helper.exe. If an agent config pointed at an API endpoint you did not set, assume its token was captured. Revoke the session, sign in again and rotate any credentials the agent could reach.

Timeline#

• Sep 29, 2026 — Checkmarx reports function-color still installable on npm as part of MALFEX.
• Oct 5, 2026 — Checkmarx publishes its MALFEX write-up.
• Oct 22, 2026 — Forever Security publishes the Downloads-folder AGENTS.md findings.
• Oct 25, 2026 — BleepingComputer reports the research; The Hacker News follows on Oct 26.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Forever Security — Hijacking AI agents via the Downloads folder forever.security
2. OpenAI — Codex docs: AGENTS.md discovery and precedence learn.chatgpt.com
3. Checkmarx Zero — MALFEX npm malware campaign: three payloads and an adversary that signs their work checkmarx.com

Coverage and analysis

1. BleepingComputer — AI coding agents hijacked using AGENTS.md file in Downloads folder bleepingcomputer.com
2. The Hacker News — Malicious file in Downloads folder tries to trick AI coding agent into installing malware thehackernews.com