An AGENTS.md file planted in a Downloads folder tried to get Codex to install a malicious npm package

Forever Security said in an October 22 report that it caught an attack on a real customer’s machine. A 13 KB AGENTS.md file, dressed up as engineering notes, sat in the user’s Downloads folder. Coding agents like OpenAI’s Codex follow this file as instructions in the folder they start in. One section told the agent to register an MCP server in ~/.codex/config.toml and install the npm package function-color, part of a malware campaign CloudSEK and Checkmarx named MALFEX. Forever stopped the agent before any code ran and could not tell how the file got there.

Forever says two harmless behaviors combine: agents trust the instructions file in their folder, and a web page can save a file to Downloads without a click. Its proof-of-concept page drops an AGENTS.md that way. Running the real file in an isolated VM, Forever said Codex executed the malware in more than 90% of attempts, and the change persisted across later sessions. Against Claude Code, a CLAUDE.md written by Forever tried to point ANTHROPIC_BASE_URL at the firm’s server. That write needs human approval and got it about half the time, leaking the login token.

In Forever’s view, there is nothing for OpenAI or Anthropic to patch, since the agents behave as designed. It says about half of its customers run a coding agent inside Downloads. Its advice is to avoid starting agents there, read unfamiliar instructions files, check agent configs and rotate tokens after a planted file turns up. The results are the company’s own tests. No statement from OpenAI or Anthropic could be found.