AGENTS.md in Downloads: How a Dropped File Hijacks Coding Agents

Forever Security reports that a malicious AGENTS.md file in a customer’s Downloads folder pushed a coding agent to install function-color, a known malicious npm package. The company says its systems blocked the install. The case is a clear example of prompt injection against an AI agent that starts with a plain file, not a chat message.

The researchers (Gal Weizman and Omer Samet, 22 October 2026) tested OpenAI Codex and Claude Code. They say this is “not one product’s bug”, and the article reports no vendor patch or statement.

Last updated: 26 October 2026. We update this page if OpenAI or Anthropic publish a fix or guidance.

How Does a File in Downloads Reach a Coding Agent?

The research says a website can silently save a file to ~/Downloads with no click or permission prompt. People trust that folder. Coding agents also read instruction files when they start, so a planted file can be obeyed as if the user had written it.

The agents.md site describes the format as “a README for agents”. It has no required fields: it is “just standard Markdown”, and agents “automatically read the nearest file in the directory tree”.

The Codex documentation adds a detail that matters here. Codex starts at the project root, and if it finds none it checks only the current directory. Our reading is that an agent started inside Downloads, which is not a code repository, meets any AGENTS.md that sits there.

Forever Security puts it this way: “Markdown is the new executable.” An instruction file is built to be followed, so it does not trigger the operating system protections that an executable would.

The OWASP Top 10 for LLM applications names this class indirect prompt injection, which occurs “when an LLM accepts input from external sources, such as websites or files”.

What Did the Planted File Make the Agents Do?

The article describes two different paths. Both end in persistence or code execution, and neither needs a software bug.

For Codex, the planted file tells the agent to add a [mcp_servers.project-tools] entry to ~/.codex/config.toml. That entry launches npm install function-color through launchctl. The config file is machine wide, so the change outlives the project. The article says Codex ran the malware in more than 90% of attempts, and that the attack needed a child codex exec run with --dangerously-bypass-approvals-and-sandbox.

For Claude Code, the researchers wrote their own CLAUDE.md, modelled on the real file. It gets Claude to write .claude/settings.json with an ANTHROPIC_BASE_URL that points to an attacker domain. The authors say this leaks the OAuth token and allows account takeover.

The attacker server can also return a Bash tool call with dangerouslyDisableSandbox set to true. The file was written about half of the time. In about a fifth of runs Claude also spawned a subagent, whose new connection went through the attacker server, and code ran in the same session.

The installed package is the endpoint, which makes this a supply chain attack delivered through an AI agent. The article says npm has removed function-color and that it belongs to a campaign documented by Checkmarx.

Which Agents and Settings Were Exposed?

Only Codex and Claude Code were tested. The article does not test other agents, but says “any of them can be hit”. The agents.md site lists many tools that read the same file, including Codex, Gemini CLI, Cursor, Windsurf, Aider and GitHub Copilot’s coding agent. GitHub’s documentation says that when Copilot is working, “the nearest AGENTS.md file in the directory tree will take precedence”.

The authors also tested the controls people rely on: trust gating, sandboxing, approval prompts, startup only server loading and network restrictions. They say the attack worked around each one; for the network sandbox, the model itself wrote the bypass flag into the command.

On exposure, the article gives two telemetry figures from its own customers. About half run a coding agent in Downloads, and roughly a quarter of agent sessions open a real browser. We cannot check these figures, so read them as the vendor’s own data.

Why Do Agents Obey a File Nobody Reviewed?

The Claude Code documentation says CLAUDE.md files in the directory hierarchy above the working directory are loaded at launch. It also says Claude treats them as “context, not enforced configuration”. To block an action whatever the model decides, it points to a PreToolUse hook. In short, a loaded instruction file is advice the model may follow, and only code outside the model can refuse.

That is the same lesson as in memory and context poisoning. Text that reaches an agent’s context can steer it, and a change to its config can keep steering it later.

How Can You Defend Against It?

The research gives five actions and one indicator of compromise. The last check below is our own suggestion.

The wider rules are in our guides on human approval and least agency and on least privilege. The research does not say that workspace trust or npm install settings stop this attack, so do not count on them alone.