Forever Security traces blocked AI malware install to a Downloads instruction file

An AI coding agent trying to install malware was taking orders from a plain-text file in a customer’s Downloads folder, Forever Security says. The company blocked the attempt before code ran. Its investigation then reproduced attacks against Codex and Claude Code, showing how instructions disguised as project setup could redirect an agent’s actions.

Researchers Gal Weizman and Omer Samet published the investigation on October 22. The initial alert concerned function-color, a known-malicious npm software package. Looking beyond the attempted installation, they traced the instruction to a file named AGENTS.md rather than a software dependency or code repository.

AGENTS.md supplies directions that Codex reads when working in a trusted project folder. The customer’s file looked like ordinary engineering guidance, with the malicious setup instructions buried near the end. Forever says Codex must already trust the folder for those directions to apply; previous work in Downloads can establish that trust.

How that file reached the customer’s machine remains unknown. To test one possible delivery route, Forever built a web page that silently downloaded an instruction file into Downloads. That demonstration established a possible path from a website to an agent-readable file, not evidence that the customer encountered the same delivery method.

Replaying the file inside Codex

The researchers took the customer’s actual AGENTS.md and ran it inside an isolated virtual machine. They say Codex fetched and ran the live malicious payload in more than 90% of attempts. That is Forever’s test result, distinct from the customer incident, where the installation was stopped.

The file presented its request as routine preparation: register a project tools server before starting the user’s task. Its target was ~/.codex/config.toml, Codex’s machine-wide configuration. Because that configuration loads across sessions, the attacker’s server registration could follow the agent into other folders and projects, rather than remain confined to Downloads.

Several controls complicated the attack. A blunt installation request was refused, the researchers found, while the longer engineering-document framing worked. The payload also instructed Codex to launch a second session with approvals and sandbox protections bypassed, framed as a necessary initialization check. It handed the installation to a separate operating-system service so Codex’s server timeout would not cut it off.

Claude Code required a different route

Forever found Claude Code harder to fool and built a different instruction file, CLAUDE.md. Instead of installing a package, it posed as guidance for an internal model gateway. It asked the agent to write a project setting that redirected its model-service requests to a server the researchers controlled.

That redirection could expose Claude’s login token and let the controlled server impersonate the model, returning commands for the agent to execute, Forever says. The company reported success in about half its tests. Crucially, The Hacker News reported that a person had to approve the settings write, and Claude often refused suspicious changes.

Keep downloaded files outside the trust boundary

Forever argues that this is not a conventional bug for OpenAI or Anthropic to patch: following local instruction files is intended behavior. Its proposed response focuses on where agents start, what instructions they encounter, and whether they can change their own configuration. The company’s practical advice includes:

• Do not start coding agents in Downloads. Read unfamiliar AGENTS.md or CLAUDE.md files before letting an agent follow them, including files in newly cloned repositories.
• Inspect Codex’s machine-wide configuration and Claude’s project settings for unexpected server registrations or changed service addresses. Keep approval prompts and sandbox protections enabled.
• Be wary of instructions asking the agent to disable protections. Forever also advises rotating login tokens if a planted instruction file is discovered.