On this page

Coding agents such as OpenAI Codex and Anthropic Claude Code routinely read instruction files in the folder where you start them. That design is useful inside a project you own. It becomes a pitfall when the same habit meets a folder the web can write into—most often ~/Downloads. On October 22, 2026, Forever Security (Gal Weizman and Omer Samet) described catching a malicious plain-text AGENTS.md on a real customer machine in that folder, after an agent tried to install the malicious npm package function-color. On October 25, 2026, BleepingComputer independently covered the research and verified a proof-of-concept download page. For the download-and-agent chain described in Forever Security and BleepingComputer, a reproduction has not been run on this site; feedback can go through the site footer contact.

If you are still choosing between those two CLIs on price and limits, start with DigIntoAI's comparison: Claude Code vs Codex: What $20 Gets You and Which to Pick.

What AGENTS.md and CLAUDE.md are—and why Downloads is special

AGENTS.md (Codex and similar agents) and CLAUDE.md (Claude Code) are plain-text instruction files. Teams use them for coding conventions, test commands, and tool setup. Agents load applicable files from the working directory and treat them as guidance for the session. That is intentional product behavior, not a hidden backdoor.

~/Downloads is special for a different reason: it is the default destination for browser downloads. Forever's report argues that a web page can drop a named file into Downloads, and that combining that write path with an agent that obeys instruction files creates a seam older desktop defenses never modeled as “executable.” BleepingComputer verified that a PoC page could download an AGENTS.md with harmless placeholder text. This is not the same as saying every page visit succeeds against every user and every agent build. Delivery of the customer file Forever found is still undetermined—researchers could not prove how it landed—and after a file exists, the agent still has to be started in that directory and still faces approval prompts, sandboxes, and trust gates depending on configuration.

In short: Downloads is a folder where untrusted text can appear without looking like traditional malware; an agent that treats that text as project policy is what turns the folder into a security concern.

Codex path: machine-wide config and function-color

The customer file Forever analyzed targeted Codex. Researchers did not invent a substitute payload for the main reproduction: they ran the real malicious AGENTS.md from the customer machine inside an isolated VM. Per Forever, the flow looks like this once Codex is opened in Downloads:

  1. Codex reads AGENTS.md as ordinary project guidance.
  2. Framed as “local developer environment” / MCP tool registration, the file steers Codex to append a block under [mcp_servers.*] in ~/.codex/config.toml—Codex's machine-wide config, not a Downloads-only setting.
  3. That registration is used to pull and run attacker-controlled tooling; in the live campaign, the package was function-color (Forever and BleepingComputer both note npm has since removed it). Forever also describes framing that pushes a child codex exec with approval/sandbox bypass flags so the install can finish.

Forever reports that in their testing, Codex completed the malware path in more than about 90% of attempts—researcher self-test, not our measurement. The sticky part is persistence: once ~/.codex/config.toml is poisoned, later Codex sessions on that machine can load the attacker's server at startup even outside Downloads. Leaving the folder does not undo a global config write.

Indicators of compromise from the research write-up include traces of installing function-color. Treat that as compromise evidence in Forever's framing, then rotate credentials and audit MCP registrations.

Claude Code variant: ANTHROPIC_BASE_URL and OAuth risk

To test whether the pattern was Codex-only, Forever crafted a separate CLAUDE.md variant (not the same file found on the customer machine). The goal was different: convince Claude Code to write project settings that set ANTHROPIC_BASE_URL in .claude/settings.json to an attacker-controlled domain dressed as an “internal gateway.”

Per Forever's description, once traffic is rerouted:

  • Claude's OAuth token can leak to the attacker-controlled endpoint (account takeover without necessarily running local malware in the first step).
  • The attacker can answer as the model and return tool calls—including ones that disable sandbox protections—leading to code execution on a later launch or, less often in their tests, via a same-session subagent “validation” spawn.

Forever reports follow-through in about 50% of their Claude tests—again researcher self-test. Claude Code was harder to fool than Codex in their narrative; success still depended on getting a settings write approved and on how aggressively the instruction file pushed. This Claude Code variant has not been reproduced on this site. For how Claude Code usage caps behave on Pro and Max (operational context, not this exploit chain), see How Claude Code Usage Limits Work on Pro and Max (October 2026).

Browser drop differences still leave a second step

BleepingComputer verified Forever's PoC download page on October 25, 2026. Their checks matter for the landing step only:

  • Chrome, Edge, and Firefox can, by default, save downloads into ~/Downloads without prompting for a save location each time (download notifications may still appear).
  • Brave prompted for approval before saving in their test—enough to surface that a file arrived.
  • After the file is on disk, the attack still requires launching the coding agent in that same directory so the instruction file is loaded.

Forever told BleepingComputer that people often run agents in Downloads to organize the folder or act on a newly downloaded file—which is exactly the habit this checklist pushes against. Browser defaults change the odds of a silent land; they do not remove the need for the agent session, nor do they prove the undetermined customer delivery path.

Checklist: working directory, strange instruction files, approvals, and sandboxes

This is the practical center of the article. You do not need a new product to act on Forever's “What you should do” list and BleepingComputer's reporting summary.

  1. Do not start Codex, Claude Code, or similar agents in ~/Downloads. Treat that folder as hostile ground for instruction-following agents. Prefer the root of the specific project you intend to work on—BleepingComputer notes that OpenAI and Anthropic commonly recommend starting agents in the project root rather than the home directory or a broad parent folder (reporting summary, not a numbered vendor advisory).
  2. Read unfamiliar AGENTS.md, CLAUDE.md, and similar files before any agent follows them. A stray instructions file in Downloads—or in a freshly cloned repo—is the whole hinge of this pattern. Long “engineering guidelines” framing is part of how the real Codex payload stayed persuasive in Forever's analysis.
  3. **Inspect ~/.codex/config.toml for unexpected [mcp_servers.*] blocks** and unexpected base-URL style fields (Forever also calls out watching a changed chatgpt_base_url). Remove registrations you did not intentionally add.
  4. Inspect project .claude/settings.json for unexpected ANTHROPIC_BASE_URL, proxies, or API endpoints you did not set. A surprise gateway URL is the Claude variant's core move in the research write-up.
  5. Keep approval prompts and sandboxes enabled. Be skeptical of instruction text that tells the agent to bypass approvals, disable the sandbox, or run “one-time” privileged checks to “validate” a tools server.
  6. If you see compromise signs, assume token theft and rotate. A stolen OAuth or session token is a live credential problem, not only a one-off download. Forever lists function-color install traces as an IoC for the campaign they stopped.

Nearby DigIntoAI coverage on agent-side security posture (different product, same “what can an agent touch” question): Devin Security Upgrade Brings Claude Mythos Deep Scans and Enterprise Credits.

“Nothing to patch” is a researcher view—not a vendor verdict

Forever argues there is “nothing here for OpenAI or Anthropic to patch,” comparing the situation to a browser that correctly renders a phishing page: the agent that follows AGENTS.md / CLAUDE.md in its working directory is doing what it was built to do, while the risk sits in the intersection of web-writable Downloads and trusted instruction files. That is the researchers' framing. This article does not treat it as an OpenAI or Anthropic official conclusion, CVE statement, or proof that every release is indefensible. Product defaults, trust gates, and sandbox policies still change outcomes—as Forever's own Codex-versus-Claude difficulty gap illustrates.

Likewise, this is not a claim that visiting a page always wins, or that all versions are lost. The documented customer incident had an undetermined delivery path; browser PoCs show a plausible land mechanism; agent compromise still depends on working directory, whether the model follows the planted section, and whether approvals or sandboxes stop the write or the privileged child command.

How to read this without panic-shipping a policy

If your team already forbids running agents outside project roots, this research mostly confirms that policy. If people casually open Codex or Claude Code in Downloads to “sort files,” that habit is the highest-leverage change. Pair it with periodic greps for unexpected MCP servers and ANTHROPIC_BASE_URL values, and with credential rotation playbooks when IoCs appear.

For the download-and-agent chain described in Forever Security and BleepingComputer, a reproduction has not been run on this site; feedback can go through the site footer contact.