A plain text file sitting in a computer's Downloads folder was enough to steer an AI coding agent toward installing malware on a customer's machine, researchers at Forever Security found, BleepingComputer reported Sunday. The finding matters for any company whose engineers use tools such as OpenAI's Codex or Anthropic's Claude Code: the researchers say the agents worked exactly as designed, so the exposure has to be closed by policy rather than a vendor patch.
What Happened
Coding agents read instruction files, typically named AGENTS.md or CLAUDE.md, from the folder they are started in. Developers use these files to tell an agent how a project is built and tested, and the agent treats what it finds there much like instructions from its user. That convenience is also the weakness: whoever writes the file can direct the agent to run commands, install software or change its settings.
Forever Security, which monitors how AI agents behave on company computers, described the case in a post titled "Markdown Is the New Executable" by researchers Gal Weizman and Omer Samet, published Oct. 22. The firm's software stopped an agent from installing function-color, a package from npm, the main public library of JavaScript code. The order came from an AGENTS.md file in the customer's Downloads folder, written to look like routine engineering notes, and the agent had been started in that folder. Forever says the package belonged to a malicious campaign that went unnoticed for about two years before Checkmarx documented it, and that npm has since removed it.
Nobody knows how the file got there. The researchers note that a web page can save a file to Downloads without a click: Chrome, Edge and Firefox use that folder by default, while Brave asks before each download, according to BleepingComputer.
How the Tests Worked
The rest of the findings are Forever's own vendor research, from reproductions in isolated environments rather than real attacks. Against Codex, the firm says the attacker's file wrote a new tool-server entry into a settings file that applies to every project on the machine, and that Codex ran the malware in more than 90% of attempts. BleepingComputer describes that test as using a harmless payload that opened the calculator app, with a 90% success rate.
Against Claude Code, a crafted CLAUDE.md told the agent to send its traffic to a server the researchers controlled. Forever says Claude wrote that setting about half the time, which exposed its login token; the researchers replayed one against Anthropic's service and were treated as the victim. Code ran in the same session about a fifth of the time, Forever says, and otherwise on the next launch. BleepingComputer puts code execution at roughly 50% of tests.
The two accounts also measure exposure differently. Weizman told BleepingComputer that hundreds of customers run agents from Downloads and that Claude Code alone launched more than 1,300 sessions there. Forever's post says about half of its customers run a coding agent in that folder. Neither source reports a response from OpenAI or Anthropic, and no CVE identifier, the standard tracking number for software flaws, is mentioned.
Why It Matters
Developer laptops hold source code, cloud credentials and access tokens, and an agent that can be quietly reconfigured is a direct route to all of them. "There is nothing here for OpenAI or Anthropic to patch," Forever wrote. BleepingComputer notes that both vendors already advise running agents only from the specific project folder.
The case extends a known risk. The Primary Wire reported in September, citing The Register, on OpenAI research into prompt injections, instructions hidden in content a model reads, that copy themselves between agents. Here the hidden instructions arrive through a folder browsers write to automatically.
Forever's recommendations: never start agents in Downloads; read any AGENTS.md or CLAUDE.md you did not write; check Codex's config.toml for unexpected [mcp_servers] blocks, tool connections defined under the Model Context Protocol, and Claude's settings.json for unfamiliar API addresses; keep approval prompts and sandboxes on; rotate credentials if compromise is suspected; and treat any machine that installed function-color as compromised. For security leaders, those steps translate into endpoint rules and developer guidance, not a patch cycle.
What to Watch
Whether OpenAI or Anthropic change how much their agents trust instruction files outside a project folder, or warn users who start them in Downloads. Also watch for further cases found outside test labs, and for any explanation of how the file reached the customer's machine.
