AI Coding Agents Hijacked by a File in Downloads: Nothing to Patch

Forever Security has discovered and reproduced an attack against AI coding agents that exploits no patchable software vulnerability, but rather the by-design behavior of browsers and language models. On October 22, 2026, the security firm published its report: an AGENTS.md or CLAUDE.md file placed in the Downloads folder causes OpenAI Codex and Claude Code to execute malicious instructions, with success rates exceeding 90% for the former and reaching roughly 50% for the latter. The most troubling finding is that no simple technical fix exists: the agent that reads and follows the file is functioning exactly as designed.

How the Instruction File Becomes a Payload

AI coding agents are designed to read instruction files in the working directory and turn them into actions. OpenAI Codex looks for AGENTS.md, while Claude Code reads CLAUDE.md. These files are plain text, not executable in the traditional sense, but to the AI agent they represent operational directives with the same force as a command.

Forever Security built the attack chain around a daily convenience: the Downloads folder is the default directory where browsers save downloaded files. According to the firm's report, cited by BleepingComputer, "it is the only folder the web can write to on its own." Chrome, Edge, and Firefox save files to Downloads without asking the user for a location or explicit permission; Brave is the exception, as it requires approval.

The researchers therefore created a web page that silently downloads an AGENTS.md file into Downloads, verified by BleepingComputer with test strings 'sensitive data here' and 'line 2'. If the developer launches the AI agent from that folder — a common practice according to Forever's data, which recorded over 1,300 Claude Code sessions started from ~/Downloads — the file is read and interpreted as a legitimate instruction.

Machine-Wide Persistence and API Hijacking

The reproduction on OpenAI Codex revealed a particularly insidious mechanism. The attack does not stop at the current session: by modifying ~/.codex/config.toml, the malicious file sets an attacker-controlled server as the endpoint. According to Forever Security's description reported by Mashable, "once written, every Codex session on the machine loads the attacker's server at startup — in any folder, in any project. You can leave the folder. The poison stays."

The scope is machine-wide because the configuration file resides in the user's home directory, not the project directory. This means changing to another folder, cloning a new repository, or restarting the terminal does not remove the compromise.

Against Claude Code the mechanism differs but is equally effective. The CLAUDE.md file induces the agent to write ANTHROPIC_BASE_URL into .claude/settings.json, redirecting API traffic to an external server. The framing as an innocuous engineering document — the file is 13 KB with an ordinary tone — bypasses the agent's refusal filters. Once the OAuth token was obtained, researchers successfully replayed it against the legitimate Anthropic service, demonstrating full account takeover. Help Net Security also reports a roughly 20% success rate for direct code execution in the same Claude Code session, via a helper agent connected to an attacker-controlled server.

"There is nothing here for OpenAI or Anthropic to patch. An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do." — Forever Security, via BleepingComputer

The Blurred Line Between Instruction and Command

The nature of the attack raises an architectural question deeper than the single compromise. Traditional OS protections — Gatekeeper, digital signatures, sandboxes, explicit permissions — are designed for binary executables. A markdown file triggers none of these alarms, requires no user authorization, and is not flagged by antivirus as a suspicious payload. Yet, through LLM interpretation, it becomes "the new executable," as Gal Weizman and Omer Samet of Forever Security told Help Net Security.

Analysis by Akshat Tyagi of HFS Research, cited by CSO Online, identifies the core problem: "The deeper problem is that these tools treat following an instruction and granting a privilege as the same act." The agent does not distinguish between a legitimate user command and a directive injected from an external file: it applies the same capabilities — package installation, command execution, configuration modification, credential access — in both cases.

This design-by-default eliminates the principle of least privilege that guides traditional software security. No intermediate authorization layer exists between reading the file and executing the action. There is no "allow/deny" for interpreting a markdown file as an operational instruction.

What to Do Now

The absence of an applicable patch makes mitigation purely operational and behavioral. The actions documented by the research and interviewed experts converge on four priorities:

Isolate the agent's working directory. Never launch AI coding agents from the Downloads folder or directories where the browser can write files. Forever Security explicitly recommends keeping agent sessions in dedicated directories with explicit control over the files present.

Check for suspicious markdown files. Verify the presence of AGENTS.md, CLAUDE.md, and variants in the working directory before launching the agent. The real-world sample was 13 KB and disguised as engineering notes: verification requires careful reading, not just automated scanning.

Isolate development environments. Run AI agents in dedicated containers or virtual machines without access to production credentials or OAuth tokens for critical services. This limits the impact of a potential API hijack.

Implement human oversight on critical actions. Configure agents to require explicit confirmation before installing packages, modifying machine-wide configuration files, or making external API calls. The social framing of the attack aims to get these actions approved: human supervision breaks the chain.

The Industry Chasing Its Own Creation

The MALFEX malware campaign, to which the npm package 'function-color' directed by the real AGENTS.md belonged, operated for roughly two years before removal. This timeframe suggests threat actors were already exploiting the attack surface of development ecosystems before the security community defined its contours.

Forever Security's report identifies no infrastructure overlaps linking the real client case to known campaigns beyond MALFEX, and does not confirm the actual delivery method of the file onto the machine — the silent browser download is a hypothesis tested via PoC, not an established fact. The Plugin4Shell attack documented by Help Net Security in September 2026, a zero-click RCE in AI agent plugins, belongs to the same risk class but uses distinct technical mechanisms.

What emerges clearly is that security-by-design for AI coding agents is, for now, an operational oxymoron. The design itself — reading instructions from text files in the working directory and turning them into privileged actions — is what enables the attack. Until the industry separates natural language interpretation from the granting of execution privileges, every markdown file in a web-writable folder will remain a potential compromise vector.

FAQ

Why isn't an antivirus enough to block this attack?

The AGENTS.md file is plain text, not binary executable code or traditional malware. Antivirus products do not flag markdown files as threats; the payload activates only when the AI agent reads and interprets it as an instruction.

Does the attack work even if I don't use the browser while working with the agent?

The file can reach the machine even without an automatic download — the delivery method in the real case is unconfirmed. However, if roughly a quarter of agent sessions open a browser, the combination of self-infection without human intervention is particularly risky for users with both behaviors.

Is there a patch or update that fixes the problem?

No. According to Forever Security, there is nothing for OpenAI or Anthropic to patch: the agent that follows instructions in the folder file works as designed. Mitigation is entirely behavioral and architectural.