A plain text file in a Downloads folder was enough to turn OpenAI's Codex into an installer for someone else's malware. Forever Security, a firm that monitors risk introduced by AI agents, caught the attempt on a real customer's machine and stopped it before any code ran. Then it rebuilt the attack and reproduced it: Codex obeyed in more than nine out of ten attempts.
The file was AGENTS.md, the instructions document a coding agent reads when it starts working in a folder. This one was dressed up as ordinary engineering notes. A section in the middle politely asked the agent to register a server in its own configuration and install a package called function-color from npm.
That package is not a hypothetical. It belongs to a malware campaign documented separately by CloudSEK and Checkmarx, which named it MALFEX. function-color pulls in a downloader called function-flag, and function-flag fetches and runs a Windows payload. Whoever wrote those notes was not asking for a dependency. They were asking for a loader.
Two Features, One Attack
The uncomfortable part is that neither half of this chain is a defect. An agent is designed to trust and follow the instruction file in the folder it opens. A web page is allowed to save a file into Downloads on its own, with no click and no save dialog, choosing both the name and the contents. Chrome, Edge and Firefox all do this by default. Put those two ordinary behaviors in the same directory and you have a delivery mechanism that requires no exploit, no zero-day, and no victim who does anything wrong.
Forever built a proof-of-concept page to close the loop, and BleepingComputer verified it: visit the page, an AGENTS.md lands in Downloads silently. The researchers could not establish how the file reached the customer's folder, which does not matter much. The mechanism works whether or not a specific attacker used it.
The Codex reproduction is the part that should worry people. The file, framed as routine project setup, told the agent to write a server entry into ~/.codex/config.toml and run a command that installed the package. That config file applies to every Codex session on the machine. A single bad session in Downloads does not poison Downloads. It poisons every folder you open afterward.
The Claude Code variant was different and less reliable. A planted CLAUDE.md posed as internal gateway setup and asked Claude to write an ANTHROPIC_BASE_URL into the project settings, pointing API traffic at a server the researchers controlled. That single line leaks the session's OAuth token, which is account takeover on its own, and lets the fake server answer as if it were the model and hand back commands the agent runs. Claude requires human approval for a write like that, and the long engineering-document framing got it approved roughly half the time.
Now the numbers. Forever says about half of its customers run a coding agent inside ~/Downloads, and roughly a quarter of agent sessions open a browser. Claude Code alone launched more than 1,300 sessions from that directory. This is not a fringe habit of a few careless developers. It is how a large share of paying customers use the product, because agents are useful for sorting a folder of downloads.
Which brings us to the claim that deserves scrutiny. There is nothing for OpenAI or Anthropic to patch, Forever argues, because an agent that follows the AGENTS.md in its folder is doing exactly what it was built to do. The analogy offered is a browser rendering a phishing page.
That is technically correct and strategically convenient. It is correct because no memory-safety bug is being exploited. It is convenient because it relocates a design decision into the category of weather. Someone chose to give a text file in the working directory the authority of operator instructions. Someone chose to let writes to a global config file pass through with the same trust as a local one. Those are product choices, not laws of nature, and the mitigation offered for both is a habit.
Compare the maturity of the neighboring layer. Browsers have spent two decades building download defenses: quarantine flags, Mark-of-the-Web, blocked file types, per-site prompts. A markdown file arrives with none of that, and its consumer is a model trained to read the text inside it as orders. The trust boundary between an operator and a stranger is a filename.
The practical guidance from Forever is worth taking, precisely because it asks nothing of the vendors:
- Never start Codex, Claude Code, Cursor or any agent inside ~/Downloads. It is the one folder the web can write to without asking.
- Read any AGENTS.md, CLAUDE.md or similar instruction file you did not write, including in repositories you just cloned.
- Inspect ~/.codex/config.toml for server blocks you did not add, and .claude/settings.json for an ANTHROPIC_BASE_URL you did not set.
- Leave approval prompts and sandboxes enabled, and treat any instruction that asks you to disable them as hostile.
- If you find a planted file, assume the login token is already gone and rotate it. A stolen token is a live session, not a single blocked request.
Every one of those items is a human behavior change standing in for a missing technical control. Good advice that stops working the moment agents get more tools and more autonomy, which is the direction every release is headed.
Codex ran the malware in more than 90% of the tests because it was being helpful, obedient and fast, which is the entire product pitch. The industry keeps telling developers that agents are finally ready to work unsupervised. A folder that any website can write to says they are ready to take dictation from strangers. Until instruction files carry provenance and global config writes get gated, running your agent from the project root is not a security model. It is a habit that happens to work most days.
Comments