Researchers at Forever Security found a malicious AGENTS.md file in a customer’s ~/Downloads folder that had steered an AI coding agent into trying to install a malicious npm package, function-color. AGENTS.md is a plain-text file of project instructions that coding agents load automatically from their working directory. The agent in this case was running from Downloads, so it followed the file’s instructions. The researchers could not determine how the file got there, but showed that a web page can silently save a file named AGENTS.md into Downloads in browsers that save without prompting (Chrome, Edge and Firefox by default, per BleepingComputer’s tests; Brave asked for approval).
Forever Security reproduced the chain against OpenAI Codex, using a harmless payload that opened the calculator app, with a 90% success rate. In a separate test, a malicious CLAUDE.md redirected Claude Code’s API traffic to a server the researchers controlled. That exposed the agent’s OAuth token, and the server could then return tool calls that executed code in roughly 50% of tests. The researchers say there is “nothing here for OpenAI or Anthropic to patch”: the agent is doing what it was built to do. They told BleepingComputer that, by their telemetry, hundreds of customers run coding agents such as Claude Code, Codex and Cursor CLI from their Downloads folders, and Claude Code alone started more than 1,300 sessions from that location. The attack still needs the user to launch an agent in that folder, and the results are from the researchers’ tests, not confirmed attacks in the wild beyond the one customer case.
How to check if you’re affected
Affected products are AI coding agents that load instruction files such as AGENTS.md or CLAUDE.md from their working directory, including Codex, Claude Code and Cursor CLI; there is no software version to patch because this is how the tools work.
- Check where you launch your agent. If it is
~/Downloads(or your home directory), start it from the specific project folder instead; OpenAI and Anthropic recommend running agents from the project root and keeping the working area as narrow as practical. - Look for unfamiliar
AGENTS.md,CLAUDE.mdor similar instruction files in Downloads and review them before letting an agent follow them. - Keep approval prompts and sandbox protections turned on, and test untrusted code in an isolated environment.
- Check your projects for the
function-colornpm package; it is the malicious package named in the report. If you find it, the cautious route (our advice, not the researchers’) is to treat the machine as compromised and rotate credentials the agent could reach.