By Josh Woodruff, Co-chair, CSA Zero Trust Working Group. Reviewed by Josh Woodruff. Published October 2026.
Yes. Coding agents read an instruction file, like AGENTS.md or CLAUDE.md, from the folder they start in. Then they act on it with every permission they hold. A web page can drop that file into your Downloads folder. Start an agent there and it may install malware or hand over its login token. Keep agents out of Downloads, and treat any instruction file you didn't review as untrusted.
How to read this post: Fact means a source says it, with the link right there. Our read is my interpretation. Do this is what I recommend.
What happened with the AGENTS.md file in Downloads?
A security firm caught a coding agent trying to install a known malicious package. The order came from a plain text file in the user's Downloads folder. Nobody knows how the file got there.
Fact: On October 22, 2026, Forever Security researchers Gal Weizman and Omer Samet reported that their product stopped a coding agent from installing function-color, a known malicious npm package. They traced the order to an AGENTS.md file in the customer's ~/Downloads folder. That folder was also the agent's working folder. Forever says it stopped the install before any code ran (Forever Security).
Fact: The researchers couldn't tell how the file landed there. They told BleepingComputer that visiting a malicious page could drop it with no user action (BleepingComputer, Oct 25, 2026).
Fact: BleepingComputer opened Forever's test page. It saved a harmless AGENTS.md file to Downloads. The outlet notes that Chrome, Edge, and Firefox save to Downloads by default without asking where, though they do show a download notice. Brave asked first (same article).
Why do coding agents obey AGENTS.md and CLAUDE.md files?
Because that's what the files are for. An instruction file tells a coding agent how a project works, like how to build and test it. The agent loads it from its working folder and follows it.
That design is fine inside a project you control. Downloads is different. Forever's report calls it "the one folder the web can write to on its own" (Forever Security).
Fact: In Forever's lab, the real attacker file got OpenAI Codex to run its payload in more than 90% of attempts. Most runs used a harmless stand-in that opened a calculator. They ran the real malware once, inside an isolated virtual machine (same report). BleepingComputer reported the figure as 90%.
Fact: The file told Codex to add a new tool server to ~/.codex/config.toml. That's Codex's config for the whole machine. So every later Codex session loads the attacker's server, in any folder. The file also got Codex to write the --dangerously-bypass-approvals-and-sandbox flag itself (same report).
Fact: Codex only follows an AGENTS.md in a folder it trusts. Forever says Downloads passes that check once you've worked there before (same report).
Fact: Claude Code was harder to fool. The researchers wrote their own CLAUDE.md for this test, based on the attacker's file. It got Claude Code to point its API traffic at a server they controlled about half the time. That handed over Claude Code's login token. They replayed one token and were served as the victim. Code ran in the same session about a fifth of the time (same report). The Claude Code results come from a lab test. Forever didn't report finding that file in the wild.
Fact: Forever says about half of its customers run a coding agent inside Downloads. Weizman told BleepingComputer that Claude Code alone launched more than 1,300 sessions from there. Those are Forever's own numbers (BleepingComputer).
Our read: The file is a prompt injection that lives on disk. It looks like boring setup notes, and the agent treats it as orders from you.
Is this a bug OpenAI or Anthropic can patch?
No. The researchers say so directly. Both agents did what they were built to do, so the fix sits with whoever runs them.
Fact: "There is nothing here for OpenAI or Anthropic to patch. An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do." That's from Forever's report, and BleepingComputer quotes the same lines (Forever Security).
Fact: OpenAI and Anthropic both tell you to start a coding agent inside the project it should work on. The Codex CLI docs say to open a project directory and run codex (OpenAI). The Claude Code quickstart has you cd into your project first (Anthropic). BleepingComputer reported the same advice (BleepingComputer).
Our read: If nobody can patch it, it's a governance job. Your developers picked where the agent started. Your company picked what it could do without asking. So the fix belongs to the people running the agents. If you run security, that's you.
What should a CISO control on developer machines running coding agents?
Five things, one for each element of the Agentic Trust Framework (ATF). The Cloud Security Alliance published ATF on February 2, 2026. I call this the Folder Check. Each answer should name a setting or an owner. "Developers know better" doesn't count.
Segmentation: where may an agent start? Keep agents out of Downloads and out of the home folder. Start each one in the root of a single project. Keep sandboxes and approval prompts on. Limit the outside hosts an agent session can reach, so a reroute to an unknown API server fails.
Data Governance: which instruction files count as yours? Only ones inside a reviewed project. Any
AGENTS.mdorCLAUDE.mdfrom a download or a fresh clone is untrusted input until someone reads it.Behavioral Monitoring: what should raise an alert? A package install from an agent session. A write to the agent's own config, like a new
[mcp_servers]block in~/.codex/config.tomlor anANTHROPIC_BASE_URLin.claude/settings.json. Any command that turns off the sandbox.Identity Management: whose session is it, and what token does it hold? Tie each agent session to a named developer. Know which login token each coding agent carries, so you can kill the right one fast.
Incident Response: what happens when you find one? Stop the session. Assume the token leaked and rotate it. Check both config files above. Forever says a machine with
function-colorinstalled should be treated as compromised. Our post on how to stop an AI agent before it acts covers the stop.
Fact: OWASP's Secure Coding with AI cheat sheet lists CLAUDE.md and AGENTS.md as rules files that steer every future session. It says to review changes to them like CI/CD pipeline changes, and to flag unexpected new ones (OWASP). Use it for the developer checklist. This post is about what you own.
Do this: Run the Folder Check on one team this week. Write the answers down where someone else can read them. Our post on what to write down before an AI agent gets a login shows the format.
How do you prove after the fact what a coding agent did?
You need a record that ties each action to one session and the person who started it. Without it, you can't tell a planted file from a developer's own mistake.
Forever caught this one because its product watched what the agent did. Check whether anything on your developer machines watches at that level.
Do this: For each coding agent session, keep five things:
The folder it started in, and who started it.
Every instruction file it loaded, with a hash of the contents.
Every write to its own config.
Every command it ran and every package it installed.
Every outside host it talked to.
In the Codex attack, the agent added a tool server through MCP, the protocol many agents use to call tools. Our post on what security teams ask about MCP before they use it covers that side. For what your auditor will ask to see, read what evidence an auditor should expect for AI agents.
Related questions
Does this affect Cursor and other coding agents?
Forever tested Codex and Claude Code only. Its report says any agent that reads an instruction file and can rewrite its own config can be driven this way. That's their view. They didn't test other agents. Weizman told BleepingComputer that customers also run Cursor CLI from Downloads.
Is a download notice in the browser enough?
No. It warns a person who's watching the screen. Forever points out that agents now browse on their own, so nobody may be there to see it.
Is this the same as prompt injection?
Yes, it's one kind. The orders hide in content the agent reads. What's new is the delivery. The web drops a file into a folder where you start agents.
What's the first step this week?
Ask your developers one question: do any of you start a coding agent in Downloads or your home folder? If the answer is yes, that's your first fix.
Book a Consult
If you want help running the Folder Check across your developer teams, book a consult. We'll map where your coding agents start and what they can do without asking. You'll leave with a fix list in priority order. Book a Consult.