AI Coding Agents: 1,300 Claude Code Sessions Exposed to Malicious AGENTS.md Hijack in Downloads Folder

Security researchers at Forever Security have documented a real-world attack in which a malicious AGENTS.md instruction file, silently saved into a customer's Downloads folder, attempted to hijack an AI coding agent into installing a known-malicious npm package, according to coverage published by BleepingComputer on October 25, 2026 and The Hacker News on October 26, 2026. The agent was stopped before any malicious code ran, but reproduction tests showed the technique succeeded against OpenAI Codex in roughly 90 percent of attempts and against Anthropic's Claude Code about half the time. The attack exploits the combination of two behaviors: coding agents are built to obey instruction files such as AGENTS.md and CLAUDE.md found in their working directory, and mainstream browsers will by default save a file named AGENTS.md into ~/Downloads without any click or permission prompt.

What was the specific vulnerability?

The vulnerability is not a flaw in any vendor's product but a design behavior: AI coding agents trust and execute the instructions in AGENTS.md or CLAUDE.md files located in the folder they open, and attackers can plant such files in ~/Downloads without the user's knowledge. According to BleepingComputer, the file found on the customer's machine was "dressed up as ordinary engineering notes" and instructed the agent to add a server to its own configuration and install the npm package 'function-color' from the public registry. That package belongs to a malware campaign that researchers at CloudSEK and Checkmarx named MALFEX: function-color pulls in a downloader called function-flag, which fetches and runs a Windows payload.

In reproduction tests against OpenAI Codex, the planted file told the agent to register a server in ~/.codex/config.toml and run a command installing the package. Because that configuration file applies to every Codex session on the machine, the change would persist across folders. Against Claude Code, a planted CLAUDE.md framed as "internal gateway setup" tried to make the agent write an ANTHROPIC_BASE_URL value into a project settings file, pointing API traffic at an attacker-controlled server. That redirect would leak the session's OAuth token, enabling full account takeover, and would let the attacker's server impersonate the model and return tool calls that execute code.

Forever Security built a proof-of-concept web page demonstrating the silent drop of an AGENTS.md into ~/Downloads, which BleepingComputer verified downloads the file with harmless test content. The default download behavior applies in Chrome, Edge, and Firefox; Brave prompts the user. How the real file landed on the targeted customer's machine could not be determined.

How was the incident detected?

The incident was detected by Forever Security on a customer's computer, where the customer's AI coding agent attempted to install the malicious npm package 'function-color'; investigation traced the attempt to the AGENTS.md file sitting in the ~/Downloads folder, which also served as the agent's working directory. The findings were published the week of October 19 to 25, 2026, with The Hacker News reporting on the disclosure on October 26, 2026. Forever's own telemetry informed the scope of the research: internal statistics show hundreds of the firm's customers run AI coding agents, including Claude Code, OpenAI Codex, and Cursor CLI, from the Downloads folder, and Claude Code alone launched more than 1,300 sessions from that location. About half of Forever's customers run a coding agent in Downloads, and roughly a quarter of agent sessions open a browser, per the firm's data cited by BleepingComputer.

What is the current impact?

The current impact is contained to one confirmed targeted customer, whose attack was stopped before any code ran, but the exposure across the user base is broad: in the Claude Code variant a successful attack leaks the session OAuth token and grants account takeover, while in the Codex variant it installs MALFEX npm malware and registers a persistent attacker server in ~/.codex/config.toml. In testing, Codex ran the payload, described as a harmless calculator-opening program, in more than 90 percent of attempts, a success rate BleepingComputer cites at 90 percent. Against Claude Code, which requires human approval for such configuration writes and often refuses, the "internal gateway setup" framing got the write approved about 50 percent of the time. Because there is no software defect, the researchers said there is nothing for the vendors to fix. "There is nothing here for OpenAI or Anthropic to patch. An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do," the researchers said, in a comparison Forever drew to a browser rendering a phishing page.

What are the next steps?

The next steps are user-side mitigations, since the vendors' products worked as designed. OpenAI and Anthropic recommend running agents from the root of the specific project directory, keeping the working scope narrow, reviewing unfamiliar instruction files before acting on them, keeping approval prompts and sandboxes enabled, and rotating login tokens if a planted file is found. Administrators should also check ~/.codex/config.toml and .claude/settings.json for unexpected server entries or ANTHROPIC_BASE_URL values. Developers who routinely open terminals or agent sessions in ~/Downloads are the population most exposed, and Forever's telemetry suggests that population is large: hundreds of its customers, and more than 1,300 Claude Code sessions, originate there.

By the numbers

Source snapshot