Malicious AGENTS.md file tricks AI coding agents into installing rogue package

On Oct. 22, 2026, Forever Security reported finding a malicious AGENTS.md file inside a customer’s ~/Downloads folder, and that file caused an AI coding agent to try installing the malicious npm package function-color.

A website can silently drop an AGENTS.md file into ~/Downloads because that directory is the one location the web can write to without user interaction. BleepingComputer verified a proof-of-concept page that downloaded an AGENTS.md file containing the strings “sensitive data here” and “line 2” into the Downloads folder. Chrome, Edge, and Firefox save web downloads to ~/Downloads by default without prompting for a save location each time.

AGENTS.md files are plain-text project-specific instructions that AI coding agents automatically load from their working directory to guide their actions. The attack requires the target to launch an AI coding agent in the same directory as the dropped file so the agent reads those instructions. Although the instructions are not executables, they can cause agents to run commands, install packages, or change settings using the tools and permissions available to the agent.

Researchers reproduced the attack against OpenAI Codex with a more than 90% success rate, showing the technique works against a widely used coding agent. They also demonstrated a related technique against Claude Code that leaks OAuth tokens and enables account takeover, succeeding in roughly half of tests. Once an agent follows malicious instructions, the planted file makes the agent rewrite its own configuration, opening a path to remote code execution or account takeover by handing over a login token.

In the Codex variant, the attacker writes configuration to ~/.codex/config.toml, a machine-wide file, so every Codex session loads the attacker’s server in any folder or project. In the Claude Code variant, the attack redirects API traffic to a researcher-controlled server, leaking the OAuth token and allowing the server to answer as the model. The Claude Code write succeeds about half the time because Claude often refuses configuration changes that look wrong unless someone frames them as routine setup.

Forever Security said it caught a live attacker on a real customer’s machine rather than only demonstrating the technique in a lab, separating the incident from purely theoretical research. The real customer file was a 13 KB document styled as routine engineering guidelines, with the attack hidden in one section near the end. Forever Security’s Gal Weizman said customers numbering in the hundreds run AI agents such as Claude Code, OpenAI Codex, and Cursor CLI out of their ~/Downloads folders. Gal Weizman cited Forever Security internal statistics showing Claude Code alone started more than 1,300 sessions from the ~/Downloads folder.

Company telemetry indicates that roughly half of Forever Security’s customers operate a coding agent out of Downloads, and browser use happens in roughly a quarter of agent sessions. Weizman said people commonly use AI agents to organize the Downloads folder or act on newly downloaded files. The issue is a property of how AI agents work rather than a bug in OpenAI Codex or Anthropic Claude Code specifically. No patch can close the vector because neither intended agent behavior nor intended browser behavior is a flaw.

Forever Security stated that nothing requires patching by OpenAI or Anthropic because an agent following AGENTS.md in its folder is behaving exactly as designed. Before Sept. 21, 2026, Claude Code looked for project-specific instructions in CLAUDE.md by default while OpenAI’s Codex and other agents used AGENTS.md. The AGENTS.md format is an open source initiative governed by the Agentic AI Foundation, an initiative under the Linux Foundation. Thariq Shihipar of Anthropic stated that Claude Code version 2.1.277 checks for and uses AGENTS.md when no CLAUDE.md exists in a folder.

Claude Code’s AGENTS.md support depends on the tool fetching feature flags from Anthropic, and without those flags support is unavailable, so Claude Code falls back to CLAUDE.md. Enterprises using Claude Code through Amazon Bedrock or Google Vertex AI may not be able to use AGENTS.md as a common instruction file because of that limitation. Users can configure which instruction files Claude Code reads, including AGENTS.md, CLAUDE.md, or both, through the /config command according to Thariq Shihipar.

In December 2025, Prompt Security researchers showed a malicious AGENTS.md in a repository could redirect an agent to scan for credentials and exfiltrate data externally. Pillar Security researchers showed in March 2025 that AI coding assistants could introduce harmful code into a project by concealing malicious instructions inside coding rules. In April 2026, NVIDIA researchers used a poisoned AGENTS.md file to get Codex to sabotage software and conceal the change.

Before letting an AI coding agent follow them, users should review any unfamiliar AGENTS.md, CLAUDE.md, or similar instruction file. Users should also turn on approval prompts and sandbox protections and examine untrusted code in a separate environment before running it on a primary machine. OpenAI and Anthropic recommend running AI coding agents from the project root rather than from a home or broad parent directory. Security teams should treat ~/Downloads as hostile ground and avoid starting Codex, Claude Code, or any agent in that folder.

If an agent followed malicious instructions, organizations should assume login tokens leaked and rotate them because deleting the text file may not undo the agent’s changes. Defenders should check ~/.codex/config.toml for unexpected [mcp_servers.*] blocks and project .claude/settings.json for ANTHROPIC_BASE_URL or proxy endpoints they did not set. An indicator of compromise is the presence of the malicious npm package function-color on a machine, which means organizations should treat the machine as compromised.

Checkmarx links the malicious npm package function-color to the MALFEX malware campaign it documented, and npm has since removed the package. Mitiga Labs released a free scanner called Skillgate that detects malicious techniques across AI instruction files including AGENTS.md and CLAUDE.md. Skillgate scanned over 50,000 files across more than 7,000 distinct public repositories and uses over 80 detection rules. During its investigation of AI instruction files, Mitiga Labs found over 1,230 hardcoded API keys and JWT tokens across tens of services.

The Menon Lab recommends treating AGENTS.md as privileged configuration rather than documentation and subjecting it to code review as rigorous as shell scripts or CI configs. Before cloning an unfamiliar repository, check for AGENTS.md and review it manually or require explicit approval before loading context files from new sources. Teams should minimize capability documentation in AGENTS.md because listing every installed skill, tool, and accessible file creates a roadmap for attackers.

Teams should scope agent permissions to the task because overly broad permissions enable zero-click exploits against AI coding assistants. They should also monitor for anomalous agent behavior because observability tools for agent monitoring can reduce cascading failures.

"We have zero agentic AI systems that are secure against these attacks."

Bruce Schneier, The Menon Lab