# An AGENTS.md file planted in a Downloads folder tried to get Codex to install a malicious npm package

> Forever Security says the file, found on a real customer’s machine, fooled Codex in more than 90% of tests; a similar attack on Claude Code worked about half the time.

- Publisher: JARRUS (@jarrus.tech), thejarrus.com
- Story date: Oct. 22, 2026 (2026-10-22)
- Published: 2026-10-27
- Tags: OpenAI, Anthropic, Safety and security, Agents
- URL: https://thejarrus.com/en/news/agents-md-trap/

Forever Security said in an October 22 report that it caught an attack on a real customer's machine. A 13 KB AGENTS.md file, dressed up as engineering notes, sat in the user's Downloads folder. Coding agents like OpenAI's Codex follow this file as instructions in the folder they start in. One section told the agent to register an MCP server in ~/.codex/config.toml and install the npm package function-color, part of a malware campaign CloudSEK and Checkmarx named MALFEX. Forever stopped the agent before any code ran and could not tell how the file got there.

Forever says two harmless behaviors combine: agents trust the instructions file in their folder, and a web page can save a file to Downloads without a click. Its proof-of-concept page drops an AGENTS.md that way. Running the real file in an isolated VM, Forever said **Codex executed the malware in more than 90% of attempts**, and the change persisted across later sessions. Against Claude Code, a CLAUDE.md written by Forever tried to point ANTHROPIC_BASE_URL at the firm's server. That write needs human approval and got it about half the time, leaking the login token.

In Forever's view, there is nothing for OpenAI or Anthropic to patch, since the agents behave as designed. It says about half of its customers run a coding agent inside Downloads. Its advice is to avoid starting agents there, read unfamiliar instructions files, check agent configs and rotate tokens after a planted file turns up. The results are the company's own tests. No statement from OpenAI or Anthropic could be found.

## Sources

1. [Forever Security (Gal Weizman, Omer Samet): Markdown Is the New Executable: Attackers Are Dropping Agent Instructions Into Your Downloads Folder From the Web, Oct. 22, 2026](https://forever.security/blog/hijacking-ai-agents-via-downloads-folder)
2. [The Hacker News: Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware, Oct. 26, 2026](https://thehackernews.com/2026/10/malicious-file-in-downloads-folder.html)
3. [Checkmarx: Analysis of the MALFEX npm campaign](https://checkmarx.com/zero-post/malfex-npm-malware-campaign-three-payloads-and-an-adversary-that-signs-their-work/)

Report an error: corrections@thejarrus.com