Downloads Is the One Folder the Web Can Write To: A Planted AGENTS.md Drove Codex Into Installing Malware

2026-10-25 Agent & Supply Chain Security by al-ice.ai Editorial

On 22 October 2026, researchers Gal Weizman and Omer Samet at Forever Security published an account of live malware they caught on a customer’s machine — and the payload was a text file. Their monitoring stopped a coding agent mid-session as it tried to install function-color, an npm package the researchers describe as part of a campaign that ran undetected for roughly two years before being documented publicly. Blocking a known-bad package is routine. The interesting part was the instruction’s origin: not a dependency, not a cloned repository, but an AGENTS.md file sitting in the customer’s ~/Downloads folder, which was also the directory the agent had been started in. Nobody on the customer’s team had written it, and nobody could say how it arrived.

That question is the whole finding. ~/Downloads is, as the report puts it, “the one folder the web can write to on its own” — a web page can save a file there, choosing both the name and the contents, with no click and no permission dialog. That has been true for decades and has been harmless for most of them, because operating systems long ago stopped letting a downloaded file execute itself. An AGENTS.md, however, is not an executable and therefore inherits none of the guardrails that apply to one. It is a plain-text file that a coding agent is built to read on startup and obey. Put the two properties in the same directory and the web gains the ability to plant instructions inside a folder the user believes only they can change. Forever’s formulation is the right one: markdown is the new executable.

Two agents, two different paths to the same outcome

Forever did not settle for the theory. For Codex, the researchers took the actual attacker file recovered from the customer’s machine and ran it unmodified inside an isolated VM, letting it fetch and execute the live payload rather than substituting a mock. The chain they describe: a page drops the file into ~/Downloads; the user later opens Codex in that folder and asks it for anything at all; before starting the requested task, the agent adds a “project tools” server to its own configuration and installs a package from npm. With the real file, that package is malware. Against a harmless stand-in that merely opened a calculator, the researchers record Codex running the payload in more than 90% of attempts.

The escalation is in which file gets rewritten. Codex’s edit lands in ~/.codex/config.toml — the machine-wide configuration, not anything scoped to the folder the session started in. Once written, every subsequent Codex session on that machine loads the attacker’s server at startup, in any project, in any directory. Leaving the Downloads folder does not undo it. A directory-local compromise becomes a host-local one on the strength of a markdown file the agent found lying on the floor.

Claude Code resisted the Codex technique, and the attack that eventually worked has a different shape entirely. A planted CLAUDE.md persuades Claude to point its own API traffic at a server the researchers controlled — an ordinary host, on a domain they own, with a valid certificate. That single redirection yields two outcomes at once: the agent’s OAuth token leaks, which is account takeover with no code executed at all, and the attacker’s server can then answer as if it were the model, returning tool calls that the agent dutifully runs. Forever reports Claude following through roughly 50% of the time. Two products, two mechanisms, one conclusion the researchers draw explicitly: this is not one vendor’s bug.

How much of this is a patch, and how much is a property

Forever’s sharpest claim is that “there is nothing here for OpenAI or Anthropic to patch. An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do” — the same way a browser rendering a phishing page is working as designed. On the instruction-following half, that is correct and worth internalising: the trust placed in a working-directory instruction file is the feature, and removing it removes the product.

We would draw the line one step further in, and this is our reading rather than the report’s. The part that turns a nuisance into host-wide persistence is not instruction-following; it is that a folder-local markdown file can authorise a write to a machine-global config, and that a config file can relocate the agent’s API endpoint. Those are scoping decisions, not laws of nature. An agent that treated ~/.codex/config.toml and ANTHROPIC_BASE_URL as privileged surfaces — writable only through an explicit, out-of-session action rather than on the say-so of whatever text happened to be in the current directory — would face the same prompt-injection pressure with a far smaller blast radius. That is precisely the separation Anthropic reached for when it put credential isolation and an out-of-model approval check into Claude Duet. “Nothing to patch” is true of the sink and much less true of the privilege it reaches.

What is actually new here

This site has covered malicious agent-instruction files before, twice through NVIDIA’s red team: indirect AGENTS.md injection in Codex via malicious dependencies in April and the follow-up in May. The sink is the same. The source is not, and that is the change that matters. In the NVIDIA work the poisoned instruction arrived inside a dependency the developer chose to install — a supply-chain step with existing controls around it: pinning, review, scanners, provenance. Here the instruction arrives by drive-by write into a directory nobody curates, from a page the user may never have deliberately visited. It is the same class of attack delivered at a strictly lower cost, and it bypasses every control built around the act of choosing a dependency.

It also rhymes with a pattern we have tracked all month under a different name: the compromise that fires simply because an agent was pointed at a directory. GitSpawn turned untrusted repositories into RCE across seven coding agents, and ZCode connected workspace MCP servers without asking. Downloads is the version of that bug where the attacker does not need you to clone anything. Forever’s closing observation generalises it well: defences built around a human — someone clicks, someone approves, someone notices — quietly degrade into assumptions when an agent stands in the human’s place. The report notes that roughly a quarter of agent sessions in its telemetry open a real browser, meaning the agent can fetch the very file that turns it around, with nobody at the screen.

Where the evidence is thinner

Three caveats belong on the record, because the report is candid about all of them and the coverage around it has not always been.

The delivery path on the real machine is undetermined. Forever found the file and could not establish how it got there. The silent-download proof-of-concept demonstrates that the route is available; it is not evidence that this route was used in the incident they caught. BleepingComputer independently loaded the researchers’ test page and confirmed it saved an AGENTS.md containing only harmless placeholder text.
The success rates are the vendor’s own measurements. The 90% figure for Codex and the ~50% figure for Claude come from Forever’s testing in Forever’s environment, against prompts Forever crafted. We did not reproduce either, and nobody should treat them as stable properties of the products; agent behaviour under adversarial text moves with every model and client release.
The exposure numbers describe one customer base. “About half of customers run an agent inside Downloads” is Forever’s telemetry across Forever’s customers — companies that bought agent-monitoring, which is not a neutral sample. Read it as evidence that the practice is common, not as an industry base rate. Separately, Weizman told BleepingComputer that Claude Code alone accounted for more than 1,300 sessions launched from that location; we carry that as a reported figure, not one we can check.

One thing we did verify first-hand: the npm registry entry for function-color now resolves to a 0.0.1-security placeholder owned by the npm account, which is the registry’s standard marker for a package pulled for malicious content. That corroborates the removal Forever describes, and it means the indicator is useful for historical install logs rather than for live blocking.

What to do

Treat ~/Downloads as hostile ground for agents, and make it a rule rather than a habit. Never start Codex, Claude Code, Cursor CLI, or any comparable tool in it, in a home directory, or in a broad parent folder. Both OpenAI and Anthropic already recommend starting an agent in the root of the specific project it should work on; the point of this research is that the recommendation is now load-bearing security guidance, not ergonomics.
Audit the agent configs that outlive the session. In ~/.codex/config.toml, look for [mcp_servers.*] blocks you did not add and for a changed chatgpt_base_url. In a project’s .claude/settings.json, look for ANTHROPIC_BASE_URL, a proxy, or any other endpoint override. These are small, greppable, high-signal checks and they belong in endpoint tooling, not in a human’s memory.
Read instruction files you did not write. A stray AGENTS.md or CLAUDE.md — in Downloads, or in a repository you just cloned — is the attack. Review it before an agent gets near it, and be especially suspicious of any such file that instructs the agent to disable approvals or sandboxing.
Assume token compromise if you find one, and rotate. A leaked OAuth token is a live session, not a single captured request. Rotate the agent’s credentials, then check provider-side usage for calls you did not make — the same discipline the month’s inference-credential incidents have been forcing on everyone else.
Keep the brakes on. Approval gates and sandboxes are what reduce a 90% execution rate to a prompt the operator can refuse. They are also the first thing a well-written malicious instruction file will ask the agent to turn off.

Our write-up is analysis of Forever Security’s 22 October 2026 research post, read first-hand in full, with BleepingComputer’s 25 October report used for the details the researchers gave it directly (the browser-behaviour testing and the session-count figure). All verification was read-only: we did not obtain, write, or run the malicious AGENTS.md, any payload, or the function-color package; we did not load the proof-of-concept download page; we did not contact any system belonging to Forever Security, its customer, OpenAI, or Anthropic. The only artefact we fetched directly was the public npm registry metadata for function-color, to confirm the package’s removal state.

Sources: