A Malicious AGENTS.md in Downloads Can Hijack Coding Agents

A markdown file with no executable code in it almost got a coding agent to install malware. On October 22, Forever Security published that a malicious AGENTS.md in a customer's ~/Downloads folder told a coding agent to install function-color, a malicious npm package. Forever says it stopped the install before any code ran. Nobody knows how the file got there.

What a malicious AGENTS.md actually did

The file was 13 KB, titled "Engineering Work Guidelines", and mostly read like dull team policy. The attack was one section framed as routine tools-server setup.

Forever then tested the same idea on two agents:

• Codex: the file told it to add a project-tools MCP server (a tool plug-in the agent can call) to ~/.codex/config.toml, and that server ran npm install function-color. It also had Codex start a child codex exec with --dangerously-bypass-approvals-and-sandbox. That config is machine-wide, so the server loads in later sessions, even from other directories. Forever reports Codex ran the malware in more than 90% of attempts. InfoWorld adds that this needed the agent to run in that directory and the directory to be trusted.
• Claude Code: a planted CLAUDE.md pushed it to set ANTHROPIC_BASE_URL in .claude/settings.json to an attacker's server posing as an internal gateway. That can leak OAuth tokens and let the server hand back commands. The config write worked about half the time, and same-session code execution about a fifth of the time.

InfoWorld also reports the researchers showed a malicious website could trigger a similar download without a separate approval prompt.

How much to trust the numbers

Most of the testing used a harmless stand-in that opened a calculator. The real package ran once, inside an isolated VM. The percentages come from the authors' own tests, with no sample sizes or method described.

Analyst Sakshi Grover of IDC called it a credible early warning, not evidence of widespread exploitation, and said the rates have not been independently validated. The authors also say there is no bug to patch because the agents behave as designed. That is their assessment, not a vendor statement.

Why this matters if you deploy coding agents

The file contains no code, so scanners looking for code see nothing. The agent reads it as instructions and acts with its own permissions. Forever's telemetry says about half of its customers run a coding agent inside Downloads. InfoWorld notes the same trick could travel through cloned repos, shared drives and package contents.

Harden your coding agents against a malicious AGENTS.md

Treat instruction files like code: someone owns them, someone reviews changes, and unknown ones don't get loaded.

1. Audit for stray files and tampered config

# Instruction files sitting where an agent could pick them up
find ~/Downloads -maxdepth 2 -name 'AGENTS.md' -o -name 'CLAUDE.md'

# Codex: unexpected MCP servers or a changed base URL
grep -nE '^\[mcp_servers\.|chatgpt_base_url' ~/.codex/config.toml

# Claude Code: a redirected API endpoint
grep -n 'ANTHROPIC_BASE_URL' ~/.claude/settings.json .claude/settings.json .claude/settings.local.json 2>/dev/null

# The indicator of compromise from the write-up
npm ls -g function-color
grep -rl 'function-color' --include=package-lock.json .

An [mcp_servers.*] block you didn't add, or any hit on function-color, means rotate credentials and investigate.

2. Keep approvals and sandboxes on

For Codex, keep the defaults the Codex config docs show in ~/.codex/config.toml:

approval_policy = "on-request"
sandbox_mode = "workspace-write"

Treat any instruction to launch Codex with --dangerously-bypass-approvals-and-sandbox as a stop sign.

For Claude Code, the permissions docs say disableBypassPermissionsMode is meant for managed settings, where users can't override it:

{
  "permissions": {
    "disableBypassPermissionsMode": "disable"
  },
  "sandbox": {
    "enabled": true,
    "allowUnsandboxedCommands": false
  }
}

The second block turns on Bash sandboxing and forbids retrying a blocked command outside it, which closes the dangerouslyDisableSandbox route Forever described.

3. Route installs through an internal registry

# .npmrc
registry=https://<your-internal-registry>/

If your registry scans or allowlists packages, a hijacked agent asking for function-color hits a wall instead of the public npm registry.

Gotchas

• Don't run agents from ~/Downloads. Run them from a directory you chose.
• A bypass flag on a child process skips the settings above, so review what your agent launches.
• Check config files after any session that touched an unfamiliar folder.

If an agent can edit its own config and spawn its own installs, a text file is enough to steer it, so lock down the config, the sandbox and the registry before the next stray download lands.