---
title: Forever Security: a malicious AGENTS.md left in a customer's Downloads folder told their coding agent to install a known-malicious npm package | ctxsec
url: https://ctxsec.com/items/forever-agents-md-downloads-folder-agent-hijack
description: ""
status: "vendor research (Forever Security, Oct 22): one in-the-wild case seen on a customer machine, plus lab reproductions on Codex and Claude Code; how the file got there is not known; success rates are the vendor's own tests"
published: 2026-10-25
---

> 

[← Context & Harness Attacks](/context) · [markdown](/items/forever-agents-md-downloads-folder-agent-hijack.md)

vendor research (Forever Security, Oct 22): one in-the-wild case seen on a customer machine, plus lab reproductions on Codex and Claude Code; how the file got there is not known; success rates are the vendor's own tests

2026-10-25

### Forever Security: a malicious AGENTS.md left in a customer's Downloads folder told their coding agent to install a known-malicious npm package

Forever Security says its product stopped a coding agent on a customer machine from installing `function-color`, a known malicious npm package. The order came from an `AGENTS.md` file in the user's `~/Downloads` folder, which was also the agent's working directory. Coding agents read that file on startup and follow it.

- **Why Downloads matters:** many browsers (Chrome, Edge, Firefox by default) save files there without asking where, so a web page can drop a file named `AGENTS.md`. BleepingComputer checked the researchers' harmless proof-of-concept page and it did save such a file; Brave asked first.
- **Lab results (vendor tests):** a planted file got OpenAI Codex to run a harmless payload in about 90% of tries. A planted `CLAUDE.md` sent Claude Code's API traffic to the researchers' server, exposing its OAuth token and returning tool calls that ran code in about half of tries.
- **How common:** Forever says about half its customers run a coding agent inside Downloads, with more than 1,300 Claude Code sessions started there.

The researchers say there is nothing for OpenAI or Anthropic to patch: the agents do what they were built to do. Both vendors already tell users to start agents in the project they are working on, not in home or download folders.

Sources: [Forever Security: Markdown Is the New Executable (Gal Weizman, Omer Samet; Oct 22)](https://forever.security/blog/hijacking-ai-agents-via-downloads-folder) · [BleepingComputer: AI coding agents hijacked using AGENTS.md file in Downloads folder (Oct 25)](https://www.bleepingcomputer.com/news/security/ai-coding-agents-hijacked-using-agentsmd-file-in-downloads-folder/)