Forever Security found a malicious AGENTS.md instruction file in a customer’s Downloads folder after blocking an attempted malware installation. Bill Toulas’s October 25 report separates that incident from the company’s subsequent tests against Codex and Claude Code.

The file presented attacker instructions as routine engineering setup. It directed the coding agent, a model that runs tasks with tools, toward the malicious npm package function-color.

Evidence status: a vendor-reported blocked attempt on a customer machine, followed by controlled demonstrations. The researchers say they stopped the original installation before code ran. They could not establish how the instruction file reached that computer.

A folder can supply instructions without earning trust

Forever’s October 22 technical report describes a browser download as a plausible delivery route. BleepingComputer independently tested a harmless download page. Browser behavior varied: some saved the file automatically, while Brave prompted for approval. Download notifications can still appear.

The next step matters: the target must run the agent in a context where it loads the planted instructions. Forever’s Codex reconstruction also depended on the folder being trusted. Visiting a website alone does not establish that an agent ran attacker code.

OpenAI’s instruction-discovery documentation confirms that Codex reads applicable instruction files before working. A familiar filename describes the file’s role; it says nothing about who placed it there.

Configuration changes can outlive the poisoned folder

In the Codex demonstration, the instructions induced changes to ~/.codex/config.toml, the user’s configuration across projects. The added tool-server entry could persist into later sessions outside Downloads. The reconstruction also induced a child session that bypassed approval and sandbox protections.

The separate Claude Code test used CLAUDE.md to redirect model API traffic through researcher-controlled infrastructure. Forever reports capturing and replaying an OAuth login token, a credential that authorizes an account session. It also demonstrated attacker-supplied tool responses. Anthropic’s settings documentation distinguishes project settings from user-wide settings; their scope affects how far a malicious change can reach.

Most testing used a harmless calculator payload. Forever also reports one execution of the actual malicious package inside an isolated virtual machine. Its success percentages describe its own tests, with no reliable deployment-wide compromise rate or complete affected-version matrix.

Keep downloaded content separate from agent authority

  • Start agents in a dedicated, reviewed project folder. Avoid Downloads, the home directory and broad parent directories as default workspaces. An unfamiliar repository still needs review.
  • Read unfamiliar AGENTS.md and CLAUDE.md files before trusting the workspace. Be especially wary of instructions to change model endpoints, register tools or weaken protections.
  • Keep approval prompts and sandboxes enabled. Treat an instruction file asking to disable them as a warning, even when it calls the change environment preparation.
  • Investigate unexpected configuration changes through an established response process. Review tool-server registrations and model API destinations, including settings that apply across projects.
  • If credentials reached an unauthorized endpoint, revoke the exposed sessions and rotate affected credentials. Removing the instruction file alone leaves any persistent configuration changes untouched.

Neither reviewed report identifies a fixed release for this chain. Forever’s claim that there is nothing vendors can patch is its interpretation; intended instruction loading does not rule out stronger controls on configuration changes.

Caveat: Forever sells agent-security monitoring and supplies the customer incident and agent-test evidence; BleepingComputer independently checked only the harmless download behavior.