585/69 Tuesday, October 27, 2026
Researchers from Forever Security disclosed the discovery of a malicious AGENTS.md file in a user’s ~/Downloads folder that attempted to instruct an AI coding agent to install an npm package named function-color, which was linked to malware. Security controls blocked the activity before the malicious code could execute. Researchers then reproduced the attack using OpenAI Codex in an isolated environment and successfully demonstrated a similar technique against Claude Code. However, it remains unclear how the malicious AGENTS.md file was initially delivered to the user’s system.
The technique abuses the behavior of AI coding agents that automatically read instruction files such as AGENTS.md or CLAUDE.md from the working directory and use their contents to guide subsequent actions. If a malicious file is placed in the Downloads folder and the user launches an agent from that same directory, the agent may be manipulated into changing configuration settings, installing packages, or executing commands within its granted permissions. Researchers also demonstrated that a website could cause a browser to download an AGENTS.md file into the Downloads directory. In testing against Claude Code, the technique could also redirect API traffic, expose an OAuth token, and potentially lead to session takeover.
Users of AI coding agents should avoid launching Codex, Claude Code, or similar tools from the Downloads folder or other directories that may contain files from untrusted sources. Agents should instead be started directly from the intended project directory, and users should review AGENTS.md, CLAUDE.md, and other instruction or configuration files that are not part of the project before allowing the agent to operate. Approval prompts and sandboxing should also remain enabled by default, and users should review changes to configuration files such as ~/.codex/config.toml or .claude/settings.json. If suspicious modifications are identified, related tokens should be treated as potentially exposed and credentials should be rotated after the incident has been contained.