One File in Your Downloads Folder Can Turn Codex and Claude Code Against You, and There Is Nothing to Patch

A security firm caught a real attack in which a single text file in a customer's Downloads folder told an AI coding agent to install malware. The agent tried to do it. And because the attack relies on two features doing exactly what they were designed to do, there is no bug for OpenAI or Anthropic to fix.

Forever Security, which monitors risks from AI agents, found a malicious AGENTS.md in a customer's ~/Downloads folder, which was also the agent's working directory, BleepingComputer reports. The agent tried to install an npm package called function-color. Forever stopped it before any code ran, and could not determine how the file got there.

Engineering notes with a payload

The file was dressed up as ordinary engineering notes. One section told the agent to add a server to its own configuration and install function-color. That package belongs to a malware campaign researchers at CloudSEK and Checkmarx named MALFEX: function-color pulls a downloader called function-flag, which fetches and runs a Windows payload.

The trick works because coding agents are built to trust the instruction file in the folder they open, and a web page can save a file to Downloads on its own. Forever built a proof of concept page that silently drops an AGENTS.md there, and BleepingComputer got a harmless copy when it tested it. Chrome, Edge and Firefox save to Downloads by default without asking where, though they show a notification. Brave asked for approval. Whether a real attacker used that route against the customer is not known.

What Codex and Claude did

Run against OpenAI Codex in an isolated machine, the real attacker file told Codex to register a server in ~/.codex/config.toml and run an install command, The Hacker News reports. That config applies to every Codex session, so the attacker's server would load in any folder afterward. Codex ran the payload in more than 90 percent of attempts.

Claude Code needed a different lure. A planted CLAUDE.md, framed as internal gateway setup, tried to get Claude to write ANTHROPIC_BASE_URL into a project settings file, pointing API traffic at Forever's server. That would leak the session login token, enough for account takeover, and let the server pose as the model and hand back commands. Claude needs a person to approve that write and often refuses, but the long engineering document framing got it approved about half the time.

"There is nothing here for OpenAI or Anthropic to patch," Forever wrote. "An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do." The firm compares it to a browser rendering a phishing page.

Why Downloads matters

Running agents from Downloads is more common than it sounds. Forever researcher Gal Weizman said hundreds of customers run Claude Code, OpenAI Codex or Cursor CLI from that folder, and Claude Code alone launched more than 1,300 sessions there. People use agents to tidy the folder or act on something they just downloaded. Forever's telemetry also shows roughly a quarter of agent sessions open a browser, so often nobody is watching when a new file lands.

That puts the burden on users. OpenAI and Anthropic recommend starting an agent in the project directory it is meant to work on, and Forever's advice is never to start one in ~/Downloads. Read any unfamiliar AGENTS.md or CLAUDE.md before an agent does, check ~/.codex/config.toml and .claude/settings.json for servers or base URLs you did not add, and keep approval prompts and sandboxes switched on. Anyone who finds a planted file should assume the login token leaked and rotate it.

Agent tooling has become a favorite target this year, from a poisoned LiteLLM release that went after GitHub tokens in Claude Code logs to this. The difference here is that nothing was poisoned. The agent just read the file in front of it.

Some offers on this page may be paid placements or contain affiliate links.