Markdown is the new executable: a planted AGENTS.md in Downloads told a coding agent to install malware

The scary AI-code stories usually start with an agent writing something sloppy. This one starts with an agent reading something it shouldn't have trusted.

What was found. Security firm Forever Security says it stopped a coding agent, mid-session on a real customer's machine, from installing function-color, a known malicious npm package. The order didn't come from a dependency or a repo. It came from an AGENTS.md file sitting in the customer's ~/Downloads folder, which was also the agent's working directory. Forever says nobody knew how the file got there. It published its research on October 22, and BleepingComputer reported it on October 25.

• The file looks boring on purpose. Forever says the planted AGENTS.md is a 13 KB "Engineering Work Guidelines" document. The attack is one section near the end, written as routine setup.
• What it tells Codex to do: before starting the user's task, append a "project-tools" MCP server to ~/.codex/config.toml that uses launchctl to run npm install function-color, then start a child codex exec with --dangerously-bypass-approvals-and-sandbox to "confirm" it loaded. The file explains away the flag as needed for network access.
• The numbers: run with the real attacker file inside an isolated VM, Codex ran the payload in more than 90% of attempts, Forever says. Because the edit lands in Codex's machine-wide config, every later Codex session on that machine loads the attacker's server, in any folder.
• Claude Code too, with a different trick. Forever wrote its own CLAUDE.md that asks Claude to set ANTHROPIC_BASE_URL in .claude/settings.json to a server the researchers controlled. Claude was "much harder to fool," Forever says, but followed through about 50% of the time, which leaked its OAuth token and let the fake server answer as the model.
• How common the setup is: in Forever's telemetry, about half of customers run a coding agent inside their Downloads folder, and roughly a quarter of agent sessions open a real browser. A researcher told BleepingComputer that Claude Code alone launched more than 1,300 sessions from that location.
• The catch: the agent still has to be started in the folder where the file landed, and browsers like Brave ask before saving a download, BleepingComputer notes. Forever's PoC needed a page visit to drop the file.

Nothing to patch. Forever's own line is the hot part: "There is nothing here for OpenAI or Anthropic to patch." An agent that obeys the AGENTS.md in its folder is doing what it was built to do. The malicious package now shows only npm's 0.0.1-security placeholder on the registry, which we checked on October 26.

Our take. We spend a lot of time on sloppy code that agents write. This is the other half: sloppy trust. An instructions file is code now, because the agent will execute whatever it says, including a flag that switches off its own sandbox. So treat ~/Downloads as hostile ground, don't launch agents there, read any AGENTS.md or CLAUDE.md you didn't write, and check ~/.codex/config.toml and .claude/settings.json for servers or URLs you didn't add. If you find one, assume the token leaked and rotate it.

What we did and didn't do: we read Forever Security's October 22 write-up and BleepingComputer's October 25 report, and checked the npm registry entry for function-color, on October 26, 2026. We did not reproduce the attack ourselves. Not sponsored; no affiliate links.