Security firm Forever Security disclosed on October 22, 2026 that it caught a booby-trapped AGENTS.md file sitting in a customer’s Downloads folder, planted there specifically to get an AI coding agent to install malware. The file read like ordinary engineering notes, but it instructed the agent to register a new server and install a malicious npm package called function-color. In testing, Forever got OpenAI’s Codex to run the payload in more than 90% of attempts, and got a modified version of the attack working against Claude Code roughly half the time. There’s no CVE here, and neither OpenAI nor Anthropic has anything to patch: both agents followed their instructions files exactly as they’re built to.
What the Attack Actually Does
AGENTS.md (and Anthropic’s equivalent, CLAUDE.md) is a plain-text convention that coding agents read and follow when they start working in a folder. That’s useful when you write the file yourself. It’s a problem when someone else does.
Forever’s proof-of-concept page silently drops an AGENTS.md file into a visitor’s Downloads folder with no click and no permission prompt. The attacker gets to pick the filename and the contents. In the real case Forever investigated, the file was disguised as routine project setup notes and told the agent to add an MCP server and install function-color, which pulls in a downloader that fetches and runs a Windows payload. CloudSEK and Checkmarx have been tracking the broader campaign, which they call MALFEX, for roughly two years before it was documented publicly.
Codex vs. Claude Code: Two Different Outcomes
The two agents didn’t fail the same way, and the gap matters if you’re deciding how worried to be.
Against Codex, the attack wrote a new entry straight into ~/.codex/config.toml, which applies machine-wide rather than to a single project, so the tainted config would follow into every session afterward. Codex ran the malicious package in more than 90% of Forever’s attempts.
Claude Code wasn’t tricked by the original file. Forever had to craft a dedicated CLAUDE.md, framed as internal gateway setup, aimed at getting Claude to write an ANTHROPIC_BASE_URL override into .claude/settings.json pointing at a server Forever controlled, which would leak the session’s OAuth token and let that server start returning its own tool calls. That config write succeeded about half the time when the framing read like a long internal engineering doc. Full same-session code execution through a spawned subagent happened in roughly a fifth of attempts. Claude’s approval prompts and its tendency to refuse clearly suspicious writes raised the bar, but didn’t close the door.
Why This Is Worth Taking Seriously
Forever’s own telemetry is the uncomfortable part: about half of its customers run a coding agent with access to their Downloads folder, and roughly a quarter of agent sessions open a browser at some point. That combination is exactly what makes the drive-by delivery path realistic rather than theoretical, even though Forever can’t confirm that’s how this particular file reached the customer’s machine.
This is the second AI-coding-agent-specific attack path ConicPlex has covered this year, after a separate flaw let attackers take over Claude Code, Codex, Copilot, and Gemini CLI through a different route entirely. The pattern underneath both is the same: these agents are built to trust local files and act on them, and that trust is now a target.
What to Actually Do About It
- Don’t start agent sessions with the working directory set to
~/Downloads. - Read any
AGENTS.mdorCLAUDE.mdyou didn’t write yourself before letting an agent act on it, including in freshly cloned repos. - Check
~/.codex/config.tomlfor MCP server entries or a base URL you don’t recognize, since that file applies across every project on the machine. - Check
.claude/settings.jsonin your projects for anANTHROPIC_BASE_URLoverride you didn’t set. - Keep approval prompts and sandboxing turned on, and treat any instruction asking the agent to disable them as a red flag by itself.
- If you find a planted file, assume the token leaked and rotate credentials rather than just deleting the file.
Teams that have wired AI agents into real build and deploy workflows, not just a chat sidebar, have the most exposure here, since a stolen token or a rewritten config can reach further than a single machine. If you’re not sure what your agents currently have access to across dev and CI, that’s a cheap thing to check before it becomes a Monday-morning incident. It’s the kind of gap ConicPlex looks for as part of AI development and integration work, alongside the dependency-scanning habits covered in our look at Anthropic’s open source vulnerability scanner.
