A Planted Instruction File in the Downloads Folder Can Hijack AI Coding Agents: What Forever Security Found, and What to Do Now

On October 22, 2026, the security company Forever Security published that it had found a malicious instruction file for AI coding agents in the Downloads folder of a customer’s machine. It says it reproduced the same kind of attack on OpenAI Codex and on Claude Code (Forever Security’s original post). Japanese media have covered it too (Mynavi News, in Japanese).

This article is for organizations that use AI coding agents at work, and for the people who run them. It is built around the original post, and separates what is confirmed, what the researchers claim, and what is still unknown. Sources are given next to each statement. The information is current as of October 28, Japan time.

Key points

• What was found is an AGENTS.md of about 13 KB in a customer’s Downloads folder. It posed as engineering work guidelines and was built to make the agent rewrite its own settings.
• Forever Security’s product stopped the agent, mid-session, as it was about to install a known malicious npm package (function-color).
• On Codex, the malware ran in more than 90% of attempts in the researchers’ tests. The Claude Code tests used a file the researchers wrote themselves: the settings file was written about half the time, and code ran in the same session about a fifth of the time.
• How the file got into the Downloads folder is unknown. Neither the original post nor the coverage I checked has a statement from OpenAI or Anthropic.
• What to check now: whether you launch agents in the Downloads folder, whether the agents’ settings files contain entries you don’t recognize, and whether any machine has installed function-color.

What was found

Forever Security’s account (original post) is as follows.

• Its product stopped a customer’s coding agent from installing function-color, mid-session. Tracing the instruction, the source was not the repository or a dependency but an AGENTS.md in the Downloads folder
• The file is a long “Engineering Work Guidelines” document of about 13 KB. The attack is one section near the end, framed as routine setup of a local development environment. The researchers say the long framing is what gets the write through, and that a short, blunt request gets refused
• The post says nobody knew who put the file there or how it got there

AGENTS.md is a Markdown file that a coding agent reads as working instructions for a project. The post’s explanation is that it is not an executable, so the OS protection that stops an executable from the internet until you approve it does not apply.

How the attack works

Here is the post’s account, by agent.

On Codex

The post’s account is:

1. The victim launches Codex in the folder with the downloaded file and asks it to do any task
2. Codex follows the AGENTS.md and adds an MCP server entry to the machine-wide settings file. The entry runs an npm install of the malicious package
3. Codex only obeys an AGENTS.md in a project it trusts. According to the post, having worked in the Downloads folder is enough for that folder to count as trusted
4. The default sandbox blocked the network fetch at first. Then the model, as the file instructed, added the flag that disables approvals and the sandbox (--dangerously-bypass-approvals-and-sandbox) to a child codex exec. A handshake timeout was worked around by running the install through launchctl

On Claude Code

The researchers’ own CLAUDE.md makes Claude Code write .claude/settings.json. When ANTHROPIC_BASE_URL points at the attacker’s server, Claude Code’s traffic goes through that server. The researchers say they showed two things:

• The OAuth token leaks. They say they replayed a captured token against the real API and showed access to the account
• The attacker’s server can pose as the model and return a Bash tool call. The researchers write that they did not break out of the sandbox

The post says Claude Code needs a human to approve a write like this, and often refuses one that looks wrong. In a folder full of security notes, a payload that worked in a clean folder failed every time, according to the researchers.

How to read the numbers

Two cautions on the numbers.

• Some Japanese coverage reports Claude Code’s roughly 50% as the rate at which it “processed remote code” (Mynavi News). In the original post, about half is the rate at which the settings file was written, and code running in the same session is about a fifth. As the rate of code execution, a fifth is the correct figure, I believe
• The Claude Code tests are results from a file the researchers made, not a real attack. Help Net Security also points out that the Codex and Claude results come from different kinds of tests (Help Net Security)

What function-color is

function-color is a malicious npm package. Checkmarx, in its October 5 report, shows it as part of a campaign it calls MALFEX, run by a single operator (Checkmarx).

• function-color has no payload of its own. It is a wrapper that installs function-flag as a dependency. function-flag fetches further payloads with an install-time script
• The operator has been active since August 2023. function-flag has been malicious since July 2025
• As of October 1, downloads were 300 for function-color and 37,419 for function-flag. The eight malicious packages together total 40,767. That is a count of registry downloads, not of infections (Checkmarx)
• The payloads are described as Windows malware (the Overlord RAT, and stealers for Discord, browsers and more)
• As of September 29, function-color was still on npm. Forever Security says npm has since removed it

Checkmarx describes Windows payloads, while Forever Security’s account of the attack involves macOS’s launchctl. How the two relate is not written in either source.

What the vendors say

The post does not mention reports to OpenAI or Anthropic, or any response from them. The Help Net Security article has no vendor statement either. In my own search, I found no official statement from either company.

The view that there is nothing for OpenAI or Anthropic to patch, and that this case will not be fixed because nothing in either agent is broken, is the researchers’ view. It is not a position the vendors have confirmed.

Here is what I could confirm in the vendors’ documentation.

• Claude Code reads AGENTS.md as project instructions when there is no CLAUDE.md in the working directory or above it. Reading AGENTS.md directly requires v2.1.277 or later (Claude Code docs)
• The same page describes CLAUDE.md as context, not enforced configuration. To block an action for certain, it points to a PreToolUse hook
• Codex reads AGENTS.md from the project root (usually the Git root) down to the working directory. If no project root is found, it checks only the working directory (Codex docs). So in a folder that is not a Git root, such as Downloads, the AGENTS.md in that folder is read. That is my reading of the docs

What to check now

The order below follows the post’s recommendations and features in the Claude Code documentation.

Today

1. Check whether AGENTS.md or CLAUDE.md files sit in the Downloads folder

find ~/Downloads -maxdepth 3 \( -name AGENTS.md -o -name CLAUDE.md \) 2>/dev/null

2. Check the agents’ settings files for entries you don’t recognize. For Codex, look at the [mcp_servers.*] blocks in ~/.codex/config.toml and any change to chatgpt_base_url. For Claude Code, look at ANTHROPIC_BASE_URL and proxy settings in .claude/settings.json (original post)
3. Check lockfiles and package lists for machines that installed function-color. If you find one, treat it as compromised (Forever Security). Check the eight malicious packages that Checkmarx lists, including function-flag, the same way

This week

4. Don’t launch agents in the Downloads folder. The same goes for folders holding files fetched in a browser, and folders of unknown origin. Do your work in project folders you created yourself
5. Read any AGENTS.md or CLAUDE.md you didn’t write before letting an agent read it. That includes copied repositories and projects you were handed
6. Keep approvals and the sandbox on. If an agent tries to use a flag or setting that disables them, stop it and find out why
7. If you find a suspicious entry or function-color, treat that machine’s authentication tokens as leaked and replace them (the post says a leaked token is the same as a live session). If you route npm through an internal registry, block the malicious packages there (Checkmarx)

This month

8. Decide, as an organization, which folders agents may run in and where they may not
9. To audit or block changes to Claude Code’s settings during a session, you can use ConfigChange hooks (Claude Code security docs). Also put changes to Codex’s settings file under monitoring (this is my own suggestion)
10. If you let agents operate a browser for you, review how far they may go. The share of sessions that open a real browser is the basis for the researchers’ concern, but the post gives no evidence that browser use put the file there

What is not confirmed

• How the file got into the customer’s Downloads folder is unknown
• How widespread real attacks are is unknown. One case on a customer’s machine is what has been confirmed
• The attack on Claude Code is a test with a file the researchers wrote, and no real attack has been confirmed
• The number of attempts is not given, so the margin of confidence in the figures is unknown
• The usage figures come from the company’s customers, and the sample and method are not given
• No official statement from OpenAI or Anthropic has been confirmed

Related articles

• A Severity 9.8 Linux Kernel Flaw: What the AI-Built Attack Needs, and Where Each Distribution Stands: An attack built by AI, demonstrated: the severity 9.8 Linux kernel flaw
• As Breaches Mount in Japan, What Leaders Should Decide First: Zero Trust and Security in the Age of AI: What executives should decide first, with breaches on the rise
• 15 Jenkins Core Flaws: Only One Works Without Login, but Some Need Nothing More Than Read Access: Another way into the development platform: 15 Jenkins core flaws

If you’d like help designing or auditing how to run AI coding agents safely inside your company, get in touch below.