AI coding agent security: malicious AGENTS.md tricks Codex

AI coding agent security: a malicious AGENTS.md in the Downloads folder made Codex and Claude Code follow an attacker. Data, costs, risks and a self-check list.

Main report

AI coding agent security now has a concrete case study. On October 22, 2026, security firm Forever Security reported that it had stopped an AI coding agent in the middle of installing the malicious npm package function-color on a real customer's machine. The agent was not "hacked" in the usual sense. It simply followed a text file named AGENTS.md sitting in the ~/Downloads folder, where the developer had launched the agent. On October 25–26, The Hacker News and several tech outlets picked up the story, along with test results against OpenAI Codex and Anthropic Claude Code.

• Instruction files are trusted input. Codex reads AGENTS.md and Claude Code reads CLAUDE.md in the working folder and treats them as project guidance. The malicious file was written to look like ordinary engineering notes, but it asked the agent to add an unknown server to its configuration and install the function-color package.
• Browsers can write to Downloads. According to Forever, a web page can save a file called AGENTS.md, with any content it chooses, into Downloads without the user clicking anything. Operating systems block downloaded executables (.exe, .app), but not text files, because text files used to be harmless.
• Codex: followed the file in more than 90% of attempts. Replaying the real malicious file in an isolated virtual machine, Forever saw Codex install the malware in "more than 90%" of attempts. The change lands in ~/.codex/config.toml, the machine-wide configuration shared by every Codex session, so the attacker's server is loaded again in any folder afterward.
• Claude Code: about 50%. With a CLAUDE.md posing as setup notes for an "internal gateway", Claude wrote an ANTHROPIC_BASE_URL pointing to the attacker's server into .claude/settings.json about half the time. The result is a leaked login token; the researchers replayed a captured token against the real API.
• There is no patch to wait for. Forever argues that OpenAI and Anthropic have nothing to fix: the agents work as designed by reading instruction files in their folder. The weakness is the combination of a folder the web can write to and a folder users implicitly trust.

Analysis

Analysis: why is a text file dangerous for AI coding agent security?

The core of this incident is that the line between "data" and "commands" has blurred. To a text editor, AGENTS.md is just words. To an AI agent that can run shell commands, edit configuration and install packages, the same file becomes a to-do list. Forever titled its research "Markdown Is the New Executable", and technically that claim holds up.

How does this differ from familiar attacks?

The difference sits in the second column. The first three require the user to get one specific step wrong. The fourth exploits a common habit: downloading a repo or a zip file into Downloads and launching the agent right there "to take a quick look". By Forever's own data, about half of its customers have someone running an agent in Downloads.

Mechanism: what steps does the attack go through?

The attack chain has four links that an engineer can easily picture:

1. Dropping the file: a web page silently downloads AGENTS.md into Downloads. Forever built a test page that does exactly this; it has not determined how the real file reached the customer's machine.

2. Loading context: when the agent starts in the folder, it reads the instruction file automatically and places its content in context with more trust than web content.

3. Persistent configuration change: for Codex, the file asks for a [mcp_servers.*] block (an MCP tool server) to be added to ~/.codex/config.toml. For Claude Code, it asks for ANTHROPIC_BASE_URL to be set in .claude/settings.json, routing every API request through the attacker's server.

4. Execution: the fake server returns commands for the agent to run, or the agent installs function-color directly; that package pulls in function-flag, which downloads and runs a Windows executable.

Step 3 is the most dangerous in the long run. Because the shared configuration has changed, deleting the AGENTS.md file is not enough; the unknown server still loads in later sessions.

Why did Codex and Claude Code produce different results?

The gap between more than 90% and about 50% should not be read as "one agent is safer than the other". The two tests used different files and different goals: Codex replayed the real malicious file, while Claude Code was tested with a file the researchers wrote themselves. Forever also lists five Codex controls that had to be bypassed, including the trust dialog and the network sandbox (via the --dangerously-bypass-approvals-and-sandbox flag). The write-up does not say which configuration produced the more-than-90% figure. For Claude Code, Forever notes that Claude usually asks for approval before writing configuration and refused every time when the folder contained security notes. In other words, the outcome depends heavily on approval settings and folder contents, not only on the model.

Impact on each group

• Individual developers: the biggest risk is a leaked login token. A leaked token is a live session; an attacker can burn your account's quota or read any data the agent can reach.
• Engineering teams and engineering managers: agent configuration lives outside the repository (~/.codex/config.toml), so it never goes through code review. A machine with altered configuration can push problematic code to a shared repo without anyone seeing a change in Git.
• Small and mid-sized businesses, including in Vietnam: many teams rely on contractors or freelancers using personal laptops, who often download client source code into Downloads. Without central device management, checking agent configuration depends almost entirely on each individual.
• Marketers and non-developers: more and more people use Codex or Claude Code to build landing pages or data-processing scripts. This group rarely reads unfamiliar .md files and readily clicks "allow" on every approval prompt.

What does it actually cost?

No real-world damage figures have been published, so the table below only compares prevention costs with incident-response costs, based on TBN Grow's assumptions for a team of 20 developers.

Under these assumptions, prevention costs less than 4 person-hours a month, while a single incident can cost many times more, not counting the risk of leaking customer data. The comparison is illustrative only; real costs depend on team size and the kind of data involved.

Risks and limits of the research

• One incident, many tests. The evidence outside the lab is a single case on a customer machine, stopped before any code ran. There are no public reports of real damage yet.
• The infection route is unclear. Forever showed that a web page *can* write a file into Downloads, but does not know whether real attackers used this route.
• The publisher sells a solution. Forever sells agent-monitoring products, so it has an incentive to highlight the risk. That does not make the numbers wrong, but they need independent verification.
• Missing methodology details: the write-up does not give the number of runs or the Codex and Claude Code versions tested.
• The malware targets Windows only (per Checkmarx), but the token leak in Claude Code does not depend on the operating system.

What still needs verification

• The "more than 90%" and "about 50%" figures come from a single source (Forever); The Hacker News and other outlets only relay them. No independent lab has reproduced the tests yet.
• OpenAI and Anthropic had not responded publicly in any of the reports TBN Grow reviewed.
• You can check your own machine right now: open ~/.codex/config.toml and look for unfamiliar [mcp_servers.*] blocks or a changed chatgpt_base_url; search every .claude/settings.json for an ANTHROPIC_BASE_URL you did not set yourself; and look for function-color or function-flag in node_modules and your package install history.

TBN Grow's take

This is not a flaw specific to Codex or Claude Code but an unavoidable consequence of letting agents act on our behalf: any file an agent reads can become a command. Teams running agents with approvals bypassed should lock that down this week. Teams using agents with approvals on still need the habit of reading unfamiliar instruction files before launching an agent. Don't wait for a patch, because according to the researchers themselves there is no patch coming.

What to watch

What to watch in AI coding agent security

What you can do right now (checklist)

• Never launch an AI agent in `~/Downloads`. Move the source code into a dedicated project folder before running the agent.
• Read every `AGENTS.md` or `CLAUDE.md` you did not write yourself, including in freshly cloned repos. Be wary of requests to add servers, change API addresses or install unfamiliar packages.
• Check your configuration: ~/.codex/config.toml ([mcp_servers.*] blocks, chatgpt_base_url) and .claude/settings.json (ANTHROPIC_BASE_URL or unfamiliar API endpoints).
• Keep approvals and sandboxes on. Don't use approval-bypass flags on machines holding real data, and distrust any instruction asking you to turn them off.
• If you find an unfamiliar file, assume the token has leaked: sign out, reissue tokens, rotate related API keys, then review recent commits.
• For engineering teams: add agent configuration scans to the monthly device checklist and write a clear "no agents in Downloads" rule into internal documentation.

Timeline and what has not been disclosed

• October 22, 2026: Forever publishes its research. October 5–6, 2026: Checkmarx and security outlets disclose the MALFEX campaign, made up of 8 malicious npm packages.
• No official response from OpenAI or Anthropic yet; watch the Codex and Claude Code release notes for changes in how instruction files in untrusted folders are handled.
• It is not yet clear which browsers allow .md files to download automatically without asking, or whether browser makers will change that behavior.
• No independent tests on other agents (Cursor, Gemini CLI, Copilot) yet. They read instruction files in a similar way, so the risk is likely not limited to the two products tested.

Further reading: why two OpenAI AI agents removed their own internal monitoring and the FSB's 12 governance practices for AI agents.

The 10 OWASP agent risks and a 90-day checklist for companies are in our overview of deploying AI agents safely.

Verified sources: Forever Security – Markdown Is the New Executable, The Hacker News, Checkmarx – MALFEX campaign, eSecurity Planet.