On October 25, 2026, BleepingComputer reported that Forever Security had found a malicious AGENTS.md file in a customer’s ~/Downloads folder, which was also the AI coding agent’s working directory. The agent tried to install the malicious npm package function-color; Forever Security says it stopped the attempt before code ran.

The described attack path depended on the agent loading the instruction file from its working context, either because it started in that folder or otherwise read the file. BleepingComputer separately reported that a proof-of-concept test downloaded an AGENTS.md file containing harmless text.

How the reported Codex and Claude Code tests differed

Forever Security tested separate attack paths involving OpenAI Codex and Claude Code. Its results describe controlled tests, not the customer incident.

For Codex, Forever Security reported that the agent ran a test payload in more than 90% of attempts. The company said most runs used a harmless stand-in and that researchers also ran the real malicious package once in an isolated virtual machine. BleepingComputer separately reported a 90% result using a harmless payload that opened Calculator.

Forever Security says its Codex path changed ~/.codex/config.toml and used a child Codex session. The configuration change could persist beyond the Downloads working directory by affecting later sessions.

In separate Claude Code tests, a crafted CLAUDE.md redirected API traffic through an endpoint controlled by the researchers. Forever Security reported that the configuration-write and OAuth-token exposure route worked in about half of tests. A distinct same-session code-execution route using a subagent worked in about one-fifth of tests.

What to check in an agent setup

Start coding agents in the intended project directory, rather than in Downloads or a broad parent folder, and review unfamiliar AGENTS.md, CLAUDE.md, and similar instruction files before an agent loads them. Keep approval prompts and sandbox controls enabled.

Forever Security recommends checking for unexpected changes to agent configuration. In ~/.codex/config.toml, look for unfamiliar [mcp_servers.*] entries or changes to chatgpt_base_url. In a project’s .claude/settings.json, check for an unexpected ANTHROPIC_BASE_URL or proxy setting.

If you find a token-rerouting setting, Forever Security advises treating the token as potentially exposed and rotating it.