A planted AGENTS.md in Downloads steered Codex to a malicious npm package

On Oct 22, 2026, Forever Security published research on a 13 KB AGENTS.md sitting in a Downloads folder, disguised as ordinary engineering guidelines.

Developer laptop. Downloads folder. A plaintext file the agent reads as instructions.

What happened#

Forever Security researchers Gal Weizman and Omer Samet wrote up the case. The planted file got OpenAI Codex to change its ~/.codex/config.toml and pull the npm package function-color. Forever's software blocked the package before it ran, and function-color has since been removed from npm.

Help Net Security (Sinisa Markovic, Oct 26) and BleepingComputer (Bill Toulas, Oct 25) both covered it.

The researchers couldn't determine how the file got into Downloads. Their post's title points at the web, and that fits: Chrome, Edge and Firefox save downloads to ~/Downloads by default. Brave prompted for approval.

In Forever's tests, Codex ran the malware in more than 90% of attempts. Claude Code followed through about 50% of the time, by writing a .claude/settings.json. A spawned subagent then gave same-session code execution about a fifth of the time.

Who is affected#

Developers who start Codex, Claude Code or a similar agent in ~/Downloads. That's more common than you'd hope. BleepingComputer reports that hundreds of Forever's customers run agents from Downloads, and Claude Code alone launched more than 1,300 sessions from there.

The same logic probably applies to any folder holding files the developer didn't write, like a home directory or a repo cloned from somewhere unfamiliar.

OpenAI and Anthropic both recommend running agents from the specific project directory. If your developers do that, the Downloads path mostly closes.

What to check this week#

• Tell developers to start agents in the project directory, never ~/Downloads or their home directory.
• Search laptops for AGENTS.md and CLAUDE.md files in Downloads and other non-project folders. Read any nobody can account for.
• Review ~/.codex/config.toml for server or package entries nobody added.
• Review .claude/settings.json files for changes nobody made, especially endpoints, hooks and permissions.
• Look for function-color in npm install history and caches. Treat any machine that ran it as compromised.
• If an agent opened a planted file, rotate that agent's login token.
• Check which managed browsers save downloads without a prompt, and whether a managed setting to prompt makes sense.

Where Harden helps, and where it doesn't#

Harden Agentic Integrity Foundation (AIF) runs on the developer laptop, outside the agent, at the agent's pre-execution hook. It checks every command, file edit and push against the session's intent before it runs. Decisions are made locally, in milliseconds, under one policy across agents.

In this story, the agent's next moves are what Harden sees. A write to ~/.codex/config.toml nobody asked for, an edit to .claude/settings.json, or an install of a package the user never mentioned are all actions the agent proposes. Harden checks each one against what the user actually asked for and can ask a human or block. The agent gets the reason and can retry a safe way.

It starts watch-only, so you can see what agents do from odd folders before you enforce anything.

Here's what it won't do. It doesn't stop a browser from saving a file to Downloads, and it doesn't vet instruction files on disk. It doesn't stop code that runs outside any agent action, and if a token has already leaked, Harden can't pull it back. It's a layer, not a perimeter, and it doesn't replace least privilege, scoped credentials or egress policy.

Read more#

For the broader setup, see how to secure coding agents on developer laptops.

• Forever Security: Markdown Is the New Executable
• Help Net Security: AI coding agents fall for malicious instructions planted in the Downloads folder
• BleepingComputer: AI coding agents hijacked using AGENTS.md file in Downloads folder