Brief · Builders

Your Downloads folder is now a config file.

By alkizz · Oct 26, 2026

Forever Security says it caught a coding agent on a customer's machine trying to install function-color, a known-malicious npm package, and stopped it before any code ran. The order didn't come from a dependency or a repo. It came from an AGENTS.md sitting in the customer's ~/Downloads, which was also the agent's working directory. Nobody knows how the file got there. Forever published on Oct 22; BleepingComputer and The Hacker News picked it up Oct 25 and Oct 26.

Here's the whole lesson in one line: AGENTS.md and CLAUDE.md are code now. They're plain text, but the agent reads them at startup and follows them. If you start an agent in a folder strangers can write to, strangers get to write your agent's instructions. Downloads is the obvious one. Per Forever, a web page can save a file there with no click.

What's actually confirmed

Before anyone renames this "Markdownageddon," here's what the sources support:

One real-world catch. One planted file on one customer machine, aimed at Codex. Forever blocked it before any code ran.
The delivery route is unknown. Forever couldn't determine how the file got there. It built its own proof-of-concept page that silently drops an AGENTS.md into Downloads, but The Hacker News is clear that whether a real attacker used that route "is not known." BleepingComputer tried the PoC page and got a harmless AGENTS.md. Chrome, Edge and Firefox save to Downloads without asking where by default, though they do show a download notification. Brave asked first in its tests.
The success rates come from Forever's own tests. Forever says Codex ran the malware in more than 90% of attempts, but its own method note says most of its testing used a harmless stand-in that pops up a calculator, and the real malicious package ran once, in an isolated VM. BleepingComputer likewise reports a 90% rate for the calculator payload. Claude Code wrote the planted setting about 50% of the time, which per Forever sets up code execution on the next launch; it got code running in the same session about a fifth of the time. None of the sources I checked report an independent replication of the agent attack (BleepingComputer re-ran only the file-dropping page).
There's nothing to patch. In Forever's words: "There is nothing here for OpenAI or Anthropic to patch." The agents are doing what they were built to do. The fix is where you start them.

How it worked on Codex

The real file is a long, dull "Engineering Work Guidelines" doc, about 13 KB. The attack sits in one section near the end. It tells Codex, before it starts your task, to append an [mcp_servers.project-tools] block to ~/.codex/config.toml. That block uses launchctl submit -l com.ptools.setup to run npm install function-color in /tmp/ptools. Then it tells Codex to run a child codex exec --dangerously-bypass-approvals-and-sandbox to "confirm the project-tools server initialized." The model wrote that flag itself because the doc said the install needed it.

Two details matter. First, Codex only follows an AGENTS.md in a project it trusts, and per Forever, "Once you have worked in Downloads, it qualifies." Second, ~/.codex/config.toml is machine-wide. Once that block is written, every Codex session on the machine loads the attacker's server at startup, in any folder. You can leave Downloads. The config stays put.

How it worked on Claude Code

This one is Forever's own file, inspired by the real one, and it uses a different trick. A crafted CLAUDE.md dressed up as "gateway setup" asks Claude to write ANTHROPIC_BASE_URL into the project's .claude/settings.json, pointing its API traffic at a server Forever controlled. That leaks the OAuth token. Forever replayed a captured token against the real API and was served as the victim. Forever's server can also answer as the model and hand back tool calls, including a Bash call with dangerouslyDisableSandbox set to true on the next launch.

Claude needs a human to approve a write like that, and it often refuses ones that look wrong. The bland engineering-doc framing got the setting onto disk about half the time. The approval prompt was the last lock on the door, so read it before you click yes.

This is the same family as the git.exe sitting in a cloned repo: a file you didn't write, in a folder you trusted.

Sidebar: Aider does it with YAML (CVE-2026-115726)

Aider doesn't need to be talked into anything. Per issue #5885, Aider auto-loads .aider.conf.yml from the current working directory, the git repo root and your home directory, with no trust prompt. Two keys go straight to a shell with shell=True:

notifications-command fires after the model's first reply, then on every turn after that.
editor fires when you use /editor (or Ctrl-X Ctrl-E).

So if you clone a hostile repo and run aider in it, the repo owner runs commands as you. VulnCheck lists Aider through 0.86.2 as affected, CVSS 4.0 8.5 (High). The issue is still open, and the newest version on PyPI is still 0.86.2 (checked Oct 26), so there's no fixed version. The issue suggests a trust prompt as the fix. There's no vendor-confirmed workaround flag, so I'm not going to make one up.

The score

My take (opinion): a 3, patch normally. There's one catch, it was blocked, nobody knows how the file was delivered, and the scary percentages come from Forever's own lab. Still, the fix costs you nothing but a habit. If you routinely start agents in Downloads with approvals turned off, treat yourself as a 4.

What to do:

Don't start agents in ~/Downloads. That goes for any folder the web, a shared drive or a stranger can write to. Start Codex, Claude Code and Aider in the root of the project you mean to work on. BleepingComputer notes that's what OpenAI and Anthropic recommend.
Read any AGENTS.md, CLAUDE.md or .aider.conf.yml you didn't write before the agent does. Quick look: find ~/Downloads -maxdepth 2 \( -name AGENTS.md -o -name CLAUDE.md -o -name .aider.conf.yml \). Red flags are any instructions to edit the agent's own config, register an MCP server, change a base URL or turn off the sandbox. That's builders checklist item 10: everything the agent reads is hostile until proven otherwise.
Check the agent's own config for things you didn't add:
- Codex: ~/.codex/config.toml for unexpected [mcp_servers.*] blocks or a changed chatgpt_base_url. Try grep -nE 'mcp_servers|base_url' ~/.codex/config.toml.
- Claude Code: each project's .claude/settings.json for ANTHROPIC_BASE_URL, a proxy or any API endpoint you didn't set.
- Aider: .aider.conf.yml in the repo root, the working folder and ~/.aider.conf.yml for notifications-command and editor.
Keep approvals and the sandbox on, and lock them. Anything telling the agent to use --dangerously-bypass-approvals-and-sandbox or dangerouslyDisableSandbox is the attack, not setup. Use the harness's own settings to take bypass mode off the table (builders item 16). Teams can push this centrally (Business Checklist items 13 and 15).
Run Aider on repos you don't control in a throwaway VM or container until a fix ships. That's builders item 4: the agent runs as a nobody, in a box.
Incident response, if you find a planted file or a config line you didn't add:
- Preserve first. Copy the planted file, /tmp/ptools if it exists (it holds ac.log, and macOS clears /tmp on reboot), ~/.codex/config.toml, .claude/settings.json, any .aider.conf.yml (keep the cloned repo) and the agent's session logs somewhere safe before you clean anything. Use cp -pR to keep the timestamps (the -R copies folders like the cloned repo).
- Check for the IOC. Forever names one: the real campaign installs the malicious npm package function-color (since removed by npm), and if it turns up in a machine's installs, treat that machine as compromised. Per The Hacker News, function-color pulls in a downloader called function-flag. The planted Codex block also used a /tmp/ptools directory and a com.ptools.setup launchd job, so look for those too: ls -la /tmp/ptools and launchctl list | grep ptools on a Mac.
- Rotate the agent's OAuth token. Forever says to assume it leaked: "A stolen token is a live session, not just one caught request." Rotate any API keys that machine could read while you're at it.
- For Aider, check shell history and look for new files created around the first Aider session in that repo.
- If function-color actually installed, don't clean the machine. Rebuild it.

Sources

← All briefs