Forever Security says a malicious AGENTS.md file in a customer's Downloads folder led an AI coding agent to try installing a malicious npm package, and that it reproduced the attack on OpenAI Codex and Claude Code
Forever Security says it found a malicious AGENTS.md file in the ~/Downloads folder of a real customer machine and stopped a coding agent, mid-session, from installing function-color, a known malicious npm package that Forever says npm has since removed.
Forever says ~/Downloads is the one folder a website can write to on its own and that a web page can download a file named AGENTS.md there silently; BleepingComputer reported on 25 October that the researchers could not determine how the file got onto the customer's machine, and that the attack also needs the user to start their AI agent in that folder.
Forever says it reproduced the attack on OpenAI Codex, which ran the malware in more than 90% of attempts in its testing, and on Claude Code, where a planted instructions file pointed Claude's API calls at Forever's own server and leaked Claude's OAuth login token, which Forever says it replayed to be served as the victim.
Forever says there is nothing for OpenAI or Anthropic to patch, because an agent following the AGENTS.md in its folder is doing what it was built to do.
- Product
- AI coding agents that load instruction files from their working directory (OpenAI Codex and Claude Code tested by Forever Security)
- Versions
- n/a — agent behaviour, not a product bug (Forever Security)
- Exploited in Australia?
- unknown
- Patch to
- No patch (Forever Security says there is nothing for OpenAI or Anthropic to patch). Per BleepingComputer: do not use ~/Downloads as an AI coding agent's working directory, start the agent in the root of the project it should work on (as OpenAI and Anthropic recommend), review unfamiliar AGENTS.md and CLAUDE.md files before letting an agent follow them, and keep approval prompts and sandbox protections on. Forever says that if function-color turns up in a machine's installs, treat that machine as compromised, and that a leaked Claude token should be rotated.