A Text File in a Downloads Folder Told an AI Coding Agent to Install Malware. It Almost Did.

On 22 October the security firm Forever published a report by researchers Gal Weizman and Omer Samet. It began with a real case. On a customer's computer, an AI coding agent tried to install an npm package called function-color, a known malicious package. Forever's tool blocked it before any code ran.

Nobody had asked the agent to install anything like it. The instruction came from a file called AGENTS.md in the customer's Downloads folder, written to look like ordinary engineering notes. The agent had been started in that folder, so it read the file and followed it. Forever could not work out how the file got there.

Why this works

Coding agents such as OpenAI's Codex and Anthropic's Claude Code look for an instruction file in the folder they are opened in: AGENTS.md for Codex and many others, CLAUDE.md for Claude Code. A team uses it to tell the agent how the project works: which commands to run, which style to follow, what not to touch. The agent treats it as guidance from the person it works for.

The Downloads folder is the one place on a computer that other people can write to. A web page can start a file download, and depending on browser settings it may save without asking. If someone then opens an agent in Downloads, perhaps to look at a file they just downloaded, the agent reads whatever instruction file is sitting there.

What the lab tests showed

After the real case, the researchers tried the same idea on purpose. These are their tests, not attacks seen in the wild:

• Codex followed a planted file that added a new MCP server, a plug-in tool, to its machine-wide settings file. That server installed the malicious package. It worked in more than 90% of their attempts. The step needed a flag that switched off the sandbox, and the model wrote that flag itself.
• Claude Code followed a planted CLAUDE.md that changed where it sends its requests to a server the attacker controlled. That leaked the user's login token. It wrote the setting in about half of attempts. In a further step, getting code to run in the same session worked about a fifth of the time.

Forever's conclusion is the uncomfortable part: there is "nothing here for OpenAI or Anthropic to patch". An agent that follows the instructions in its folder is doing exactly what it was built to do. The fix is in how people use it.

Six checks for anyone who runs a coding agent

1. Never open an agent in Downloads, Desktop or your home folder. Open it in the project folder you mean to work on. If you need it to look at a downloaded file, move the file into a project first.
2. Read any AGENTS.md or CLAUDE.md you did not write. Before you start an agent in a folder, check for these files there and in the folders above it. A legitimate one talks about the project. One that tells the agent to install packages, add tools, change settings or contact a server is a warning.
3. Check your agent's settings files for changes you did not make. For Codex, look in ~/.codex/config.toml for [mcp_servers] entries or a changed base URL. For Claude Code, look in .claude/settings.json in each project and in your home folder for an ANTHROPIC_BASE_URL or any other address you did not set.
4. Keep approval prompts and the sandbox switched on. Both attacks needed them off. If an agent asks to run with approvals bypassed or the sandbox disabled, say no unless you know exactly why.
5. Treat package installs as a decision, not a step. An agent that adds an npm or pip package is adding someone else's code to your machine. Ask for a reason, check the package name and its downloads, and look out for names close to a popular package.
6. If anything looks wrong, change your keys. A stolen login token or API key works until it is replaced. Sign out of the agent, rotate the provider key, and check the provider's usage page for activity you do not recognise.

A quick look for the files and settings named in the report, on a Mac or Linux machine:

ls -la ~/Downloads/AGENTS.md ~/Downloads/CLAUDE.md 2>/dev/null
grep -n "mcp_servers\|base_url" ~/.codex/config.toml 2>/dev/null
grep -n "BASE_URL" ~/.claude/settings.json .claude/settings.json 2>/dev/null

No output means none of those files or settings exist. Anything that does show up, read it before you open an agent again.

The bigger pattern

This is not the first story like this. Earlier this month we wrote about agents publishing private screenshots to public GitHub and about vetting the skills you give an agent. In each case the agent was not hacked in the usual sense. It was told something by a source it should not have trusted.

For an AI agent, a text file is as good as a program. Treat files that tell agents what to do the way you would treat a script someone emailed you: read it before you let anything run it.

Sources

• Forever Security, Gal Weizman and Omer Samet, Markdown Is the New Executable: Attackers Are Dropping Agent Instructions Into Your Downloads Folder From the Web, 22 October 2026. The customer incident, the function-color package (since removed from npm), the AGENTS.md in ~/Downloads, the unknown origin of the file, the Codex and Claude Code lab tests and their success rates, the customer telemetry, the "nothing to patch" conclusion and the recommended checks.
• The Hacker News, Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware, October 2026. News coverage of the same report.