AGENTS.md in Downloads Hijacks Codex in 90% of Forever Tests

Forever Security caught an AI coding agent on a customer machine mid-task, trying to install a known-malicious npm package called `function-color`. The instructions did not come from the developer. They came from an `AGENTS.md` file sitting in the user's Downloads folder, dressed up as ordinary engineering notes, with one section telling the agent to add a server to its own configuration and pull the package.

In testing, OpenAI's Codex followed the planted file in more than 90% of attempts, according to the firm's writeup as covered by The Hacker News. A Claude Code variant that rerouted the agent's API endpoint succeeded about half the time; same-session code execution landed in roughly one in five tries. Each successful Claude run shipped an OAuth token to a server the researchers controlled, and they replayed it against the real API and were served as the victim.

The exposure is not hypothetical. "Hundreds of customers run agents including Claude Code, Codex and Cursor CLI from Downloads," researcher Gal Weizman said in one of the follow-up writeups, adding that "people often use agents to organise the Downloads folder or act on a newly downloaded file." Forever puts the pattern at about half of its customer base, with roughly a quarter of agent sessions opening a real browser. That is enough surface for a drive-by page to drop the file silently, since browsers can save a download with no click and the page picks the name.

The problem: "An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do." Browsers save files to Downloads by design. Forever's framing is that there is nothing here for OpenAI or Anthropic to patch, which puts the burden on developers and on endpoint tooling. The firm advises not launching coding agents in `~/Downloads`, auditing stray `AGENTS.md` and `CLAUDE.md` files, inspecting `~/.codex/config.toml` and `.claude/settings.json` for unfamiliar entries, and rotating tokens when a planted file is found.

`function-color` is not new. Checkmarx and CloudSEK tied it to the broader MALFEX npm campaign, and the package sat on the registry for roughly two years before npm replaced it with a `0.0.1-security` holding version. What is new is a credible path from a drive-by web page to its installation through a tool the developer trusts. It arrives two days after Anthropic open-sourced its Claude Code sandbox, one of 525 agent stories we have tracked in the last 90 days.