Skip to content
Neural Daily

ToolsNews

AGENTS.md in Downloads: how coding agents get hijacked

🇭🇺 Olvasd el magyarul →

A malicious AGENTS.md found on a customer machine got Codex to install malware. Researchers say there is nothing to patch, so the defense falls on users.

By: Mikola Máté Patrik · · 3 min read

Close-up of colorful source code on a computer screen
Image: Markus Spiske / Unsplash · CC0 · CC0, originally published on Unsplash, via Wikimedia Commons · Source

What happened?

On October 22, Forever Security reported (Forever Security) that it had stopped a coding agent on a customer's machine from installing function-color, a known malicious npm package. The instruction did not come from a dependency but from an AGENTS.md file in the user's ~/Downloads folder. The agent used that folder as its working directory, so it loaded the file on startup and followed it. How the file got there is unknown.

The researchers note that Downloads is special: a web page can save a file there without a click, choosing both name and contents. BleepingComputer checked the company's proof-of-concept page, which did download a harmless AGENTS.md (BleepingComputer). Chrome, Edge and Firefox save to Downloads without asking by default, though they show a notification.

How well does it work?

  • Codex: using the real attacker file in an isolated VM, the malware ran in more than 90% of attempts. The file adds an MCP server to the machine-wide ~/.codex/config.toml, so every later Codex session loads it, in any folder.
  • Claude Code: harder to fool. A custom CLAUDE.md got Claude to point its API traffic at the researchers' server via .claude/settings.json about half the time. That leaked the OAuth token, which alone means account takeover.
  • On the next launch, the fake server answered as the model and ran a command with the sandbox disabled. Within the same session this worked about a fifth of the time.

According to the company's telemetry, about half of its customers run a coding agent inside Downloads, and roughly a quarter of agent sessions open a real browser. The researchers say there is nothing for OpenAI or Anthropic to patch: the agent does exactly what it was built to do.

What to do

  • Never start a coding agent in ~/Downloads or any broad, untrusted directory. Always start it in the root of the specific project.
  • Review unfamiliar AGENTS.md and CLAUDE.md files before an agent follows them, including in freshly cloned repos.
  • Keep approval prompts and the sandbox enabled.
  • Check the mcp_servers section of ~/.codex/config.toml and any .claude/settings.json files for unknown entries.
  • In corporate environments, monitor npm installs launched by agents and changes to agent config files.

The lesson goes beyond this case: agents may treat any text in their context as instructions. Where security used to rely on the user having to do something, the agent now takes that step for them.

    Produced with the help of AI, reviewed by an editor. How we make our articles

    Reviewed and edited by the Neural Daily desk. About

    Related articles