---
title: "Planted AGENTS.md in Downloads Hijacks AI Coding Agents"
url: https://erroneo.us/security/briefs/agents-md-downloads-folder-coding-agent-hijack/
description: "A malicious AGENTS.md found in a user's Downloads folder told Codex to install npm malware. No patch is coming. Don't run coding agents from Downloads or $HOME."
type: security-brief
section: "Security Digest"
date_published: 2026-10-22
date_modified: 2026-10-26
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: []
severity: "medium"
exploited: "in-the-wild"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# Planted AGENTS.md in Downloads Hijacks AI Coding Agents

**Verdict: Check exposure.** This is not a bug anyone will patch: agents read instruction files in their working directory by design. If you launch coding agents from Downloads or your home folder, stop, and check your agent configs for entries you did not add.

- **Who must act:** Developers who start Codex, Claude Code, Cursor CLI or similar agents in ~/Downloads, $HOME or other folders that collect files from the web, and teams that let agents run with approvals or sandboxing turned off.
- **Who can relax:** People who only run agents inside project repositories they cloned and reviewed, with approval prompts and sandboxing left on.
- **Affected:** Coding agents that auto-load AGENTS.md, CLAUDE.md or similar instruction files from the working directory, when started in a folder an attacker can write to (Forever tested OpenAI Codex and Claude Code)
- **Fixed:** No fix planned; mitigation is operational (working directory choice, approval gates, sandboxing)
- **CVEs:** none
- **CISA KEV:** no · **Exploitation:** Exploited in the wild

## What to do

1. Never start a coding agent in ~/Downloads, ~/Desktop or $HOME; cd into a specific project directory first.
2. Check ~/Downloads for stray instruction files (ls -la ~/Downloads/AGENTS.md ~/Downloads/CLAUDE.md) and delete any you did not create.
3. Inspect ~/.codex/config.toml for [mcp_servers.*] blocks or a chatgpt_base_url you did not add, and .claude/settings.json files for an ANTHROPIC_BASE_URL or proxy you did not set.
4. Keep approval prompts and sandboxing on, and treat any instruction file that asks an agent to bypass them as hostile.
5. Read unfamiliar AGENTS.md or CLAUDE.md files in new repositories before letting an agent act on them.
6. If function-color or function-flag was ever installed on a Windows machine, treat it as compromised and rotate credentials from a clean system.

### How to check if you are affected

- Search for planted instruction files: find ~/Downloads ~/Desktop -maxdepth 2 -iname 'AGENTS*.md' -o -iname 'CLAUDE.md'
- Check for the malware packages: npm ls -g function-color function-flag, and search lockfiles and npm caches for either name.
- Review agent configs: grep -n -e mcp_servers -e base_url ~/.codex/config.toml, and grep -rn ANTHROPIC_BASE_URL in .claude/settings.json files.
- On Windows, look for the MALFEX host artifacts Checkmarx lists, such as %APPDATA%\node.exe and %APPDATA%\Microsoft\Windows\node_runtime_helper.exe.

## What happened

On October 22, 2026, the agent-security firm [Forever Security](https://forever.security/blog/hijacking-ai-agents-via-downloads-folder) described a malicious `AGENTS.md` it found in the `~/Downloads` folder of a real customer's machine. The roughly 13 KB file looked like ordinary "Engineering Work Guidelines". A section near the end, written as routine local setup, told the agent to do three things: register an extra tool server in the machine-wide Codex config, have that config install an npm package, and start a child session with the approval and sandbox bypass flags. Forever found the file when its product blocked a coding agent from installing the known-malicious package `function-color` mid-session. [The Hacker News](https://thehackernews.com/2026/10/malicious-file-in-downloads-folder.html) reports that the agent was stopped before any code ran. How the file got onto the machine is unknown.

`function-color` is part of the MALFEX campaign that [Checkmarx](https://checkmarx.com/zero-post/malfex-npm-malware-campaign-three-payloads-and-an-adversary-that-signs-their-work/) documented earlier this month. It is a wrapper that installs `function-flag`, whose postinstall script downloads and runs a Windows executable. Checkmarx said on September 29 that it was still installable with no advisory. Forever says it has since been removed from npm.

## Who is affected

Any coding agent that automatically reads instruction files from its working directory, when it is started in a folder an attacker can write to. Codex's [documentation](https://learn.chatgpt.com/docs/agent-configuration/agents-md) describes the behavior: it walks from the project root down to the working directory and loads the `AGENTS.md` it finds at each level. If it cannot find a project root, "it only checks the current directory." Start Codex in `~/Downloads` and whatever `AGENTS.md` sits there becomes part of its instructions.

Forever reproduced the real file against OpenAI Codex in an isolated VM, and the malware ran in more than 90% of attempts. Because the edits went into `~/.codex/config.toml`, they would affect every later Codex session on the machine. Against Claude Code, Forever used a separate, crafted `CLAUDE.md`. It got Claude Code to write a `.claude/settings.json` with an attacker-controlled `ANTHROPIC_BASE_URL` in about half of attempts, which exposed the session's OAuth token to that server. [BleepingComputer](https://www.bleepingcomputer.com/news/security/ai-coding-agents-hijacked-using-agentsmd-file-in-downloads-folder/) notes that Cursor CLI was mentioned but not tested.

The habit is common. Forever's telemetry says about half of its customers run a coding agent in their Downloads folder, and BleepingComputer cites more than 1,300 Claude Code sessions launched from that location.

## Do you really need to act?

Only if your habits match. Two conditions both have to hold: an attacker gets a file into a folder you later point an agent at, and you then launch the agent there. Browsers save to `~/Downloads` by default, so the first condition is easier than it sounds. Forever argues a web page could drop the file there, although it has not shown how this particular file arrived. Starting agents from your project directories breaks the chain.

There is no CVE and no patch. As Forever puts it, "There is nothing here for OpenAI or Anthropic to patch": the agents did what instruction files told them. That puts the defense on your side. Choose the working directory deliberately, keep approval prompts and sandboxing on, and read instruction files you did not write. This is a single observed case, not a reported mass campaign. It is still a real, in-the-wild example of instruction-file poisoning aimed at developer machines, carrying real npm malware.

## What to do now

1. Start agents only inside a specific project: `cd ~/code/my-project && codex`, never from `~/Downloads`, `~/Desktop` or `~`.
2. Remove stray instruction files: `ls -la ~/Downloads/AGENTS.md ~/Downloads/CLAUDE.md`, and delete any you did not create.
3. Audit agent configs. Look in `~/.codex/config.toml` for `[mcp_servers.*]` blocks or a `chatgpt_base_url` you did not add. Look in `.claude/settings.json` files for an `ANTHROPIC_BASE_URL` or proxy you did not set.
4. Keep approvals and sandboxing enabled. An instruction file that asks for bypass flags is a red flag in itself.
5. Read unfamiliar `AGENTS.md` and `CLAUDE.md` files in newly cloned repositories before letting an agent act on them.

## How to tell if you were hit

Search for planted files with `find ~/Downloads ~/Desktop -maxdepth 2 \( -iname 'AGENTS*.md' -o -iname 'CLAUDE.md' \)`. Check for the packages with `npm ls -g function-color function-flag` and by searching lockfiles. Forever says any machine that installed `function-color` should be treated as compromised. Checkmarx lists Windows artifacts such as `%APPDATA%\node.exe` and `%APPDATA%\Microsoft\Windows\node_runtime_helper.exe`. If an agent config pointed at an API endpoint you did not set, assume its token was captured. Revoke the session, sign in again and rotate any credentials the agent could reach.

## Timeline

- Sep 29, 2026 — Checkmarx reports function-color still installable on npm as part of MALFEX.
- Oct 5, 2026 — Checkmarx publishes its MALFEX write-up.
- Oct 22, 2026 — Forever Security publishes the Downloads-folder AGENTS.md findings.
- Oct 25, 2026 — BleepingComputer reports the research; The Hacker News follows on Oct 26.

## Sources

1. [Forever Security — Hijacking AI agents via the Downloads folder](https://forever.security/blog/hijacking-ai-agents-via-downloads-folder)
2. [OpenAI — Codex docs: AGENTS.md discovery and precedence](https://learn.chatgpt.com/docs/agent-configuration/agents-md)
3. [Checkmarx Zero — MALFEX npm malware campaign: three payloads and an adversary that signs their work](https://checkmarx.com/zero-post/malfex-npm-malware-campaign-three-payloads-and-an-adversary-that-signs-their-work/)
4. [BleepingComputer — AI coding agents hijacked using AGENTS.md file in Downloads folder](https://www.bleepingcomputer.com/news/security/ai-coding-agents-hijacked-using-agentsmd-file-in-downloads-folder/)
5. [The Hacker News — Malicious file in Downloads folder tries to trick AI coding agent into installing malware](https://thehackernews.com/2026/10/malicious-file-in-downloads-folder.html)

---
Source page: https://erroneo.us/security/briefs/agents-md-downloads-folder-coding-agent-hijack/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt