A security firm says it caught an AI coding agent on a customer’s computer trying to install a malicious software package after following instructions in a file left in the customer’s Downloads folder. Forever Security, which monitors AI agents for security risks, said it stopped the installation before any code ran, and that its tests showed the same technique could take control of OpenAI’s Codex and Anthropic’s Claude Code.
The file was named AGENTS.md, a plain-text file that coding agents read for project instructions when they start in a folder. The agent had been started in Downloads, so it read the file and tried to install function-color, a package from a publicly documented malicious npm campaign that npm has since removed. In an October 22 report, Forever said that “nobody knew how it got there.”
Forever argues that a web page can save such a file to the Downloads folder without a click or approval, choosing its name and contents. When BleepingComputer opened a proof-of-concept page from the researchers, it downloaded an AGENTS.md file containing harmless text. Chrome, Edge and Firefox save downloads to that folder by default without asking where to put them, though they display a download notification, while Brave asked for approval in BleepingComputer’s tests.
Forever ran the attacker’s file, a 13 KB document styled as engineering guidelines, against Codex in an isolated virtual machine. Codex follows an AGENTS.md file only in a project it trusts, which Forever says Downloads becomes once someone has worked there with the agent. The file told Codex to add a tool server to its machine-wide configuration, with a startup command that installs the package, and then to start a second Codex session with a flag that turns off approvals and the sandbox. Forever said Codex ran the malware in more than 90 percent of attempts. Most of its tests used a harmless stand-in that opens a calculator, and it ran the real package once.
For Claude Code, Forever wrote its own CLAUDE.md file modeled on the attacker’s document. It asked Claude to save a project settings file that sent the agent’s API traffic to a server Forever controlled. Claude needs a person to approve that kind of change and often refuses, and Forever said the file was saved about half the time. Once traffic was rerouted, Forever said it captured Claude’s OAuth login token, replayed it against Anthropic’s API and was served as the victim. It said its server could also send back commands for the agent to run.
Forever said that in its telemetry, about half of its customers run a coding agent inside the Downloads folder. “There is nothing here for OpenAI or Anthropic to patch,” the company wrote, because the agents are following the files as designed. Neither Forever’s report nor BleepingComputer’s article includes comment from OpenAI or Anthropic, though BleepingComputer noted that both companies recommend starting coding agents in the folder of the project they are meant to work on.
Forever recommends that users not start coding agents in the Downloads folder and look for instruction files they did not write. It also advises checking Codex’s configuration for unexpected tool servers and Claude Code’s settings for an API address the user did not set, keeping approval prompts and sandboxes on, and rotating tokens if a planted file turns up.
Forever researcher Gal Weizman, who co-wrote the report, previously published research showing how browser extensions can take over AI assistants.
Sources: Forever Security, BleepingComputer
–
By the Control Plane Editorial Team