A planted AGENTS.md in a Downloads folder told a coding agent to install malware. Researchers made Codex and Claude Code obey

Your coding agent reads the instructions file in whatever folder you start it in. Somebody noticed which folder the whole internet can write to.

What happened

Forever Security stopped a coding agent, mid-session, as it tried to install function-color, an npm package from a known malware campaign. The order didn't come from a dependency or a repo. It came from an AGENTS.md in the customer's ~/Downloads folder, a long, bland 'engineering guidelines' file with the attack tucked near the end. Nobody knew how it got there. But the researchers showed that a web page can save a file into Downloads with no click and no prompt in several browsers.

The damage

Forever stopped it before any code ran. Run in an isolated VM, the real file got Codex to add a 'project tools' server to its machine-wide config and launch a child session with --dangerously-bypass-approvals-and-sandbox, a flag the model wrote itself. Across the tests, Codex followed through in more than 90% of attempts, and the config change sticks for every future session. A crafted CLAUDE.md got Claude Code to point its API traffic at the researchers' server about half the time, leaking its login token.

How it was caught, and what happened next

Forever says there's nothing for OpenAI or Anthropic to patch: the agents did what they were built to do. Its telemetry shows about half of customers run a coding agent inside Downloads. The npm package has since been removed.