The AGENTS.md attack is simple: a web page silently drops an instruction file into your Downloads folder, and a coding agent opened there treats it as your orders. Security firm Forever Security says OpenAI’s Codex followed such a file in over 90% of its test attempts.
Nothing is “broken” in the usual sense, which is what makes this one tricky. Here’s how it works and what to do today.
Quick facts first.
- Reported by Forever Security, covered by The Hacker News on October 26, 2026.
- Affects Codex and Claude Code when launched from a folder holding a planted instruction file.
- Codex ran the payload in over 90% of attempts; Claude Code wrote the bad config about half the time.
- No patch is coming, because the agents work as designed.
- The fix is a habit: never start an agent in Downloads.
That list is the short version. The details below explain why it works.
How the AGENTS.md attack works
Coding agents read an instructions file, usually AGENTS.md or CLAUDE.md, from the folder they open. That is a feature. It lets you tell the agent your project rules once.
The second ingredient is your browser. Chrome, Edge, and Firefox can save a file to Downloads without a prompt, and the page picks the file name and contents. Forever Security built a proof-of-concept page that does exactly that, and BleepingComputer reportedly confirmed it, according to a DEV Community write-up. Brave asks first.
Put them together and the web can write a note that your agent will read as trusted. Each behavior is harmless alone.
What the planted file actually tried to do
Forever Security caught the real case on a customer’s machine and stopped the agent before any code ran. The file looked like ordinary engineering notes. It told the agent to add a server to its own config and install an npm package called function-color.
That package belongs to the MALFEX malware campaign, which pulls in a downloader that fetches a Windows payload. The report does not say how the file reached that customer’s Downloads folder.
The attack hits the two tools differently, as the table shows.
| Agent | What the file asked for | Result in tests |
|---|---|---|
| OpenAI Codex | Register a server in ~/.codex/config.toml and install the package |
Ran in over 90% of attempts |
| Claude Code | Write an ANTHROPIC_BASE_URL into project settings, using a “gateway setup” story |
Approved about half the time; failed in a folder full of security notes |
The Claude Code route would send your API traffic, and your login token, to an attacker’s server. These are lab results, and attempt counts and agent versions were not published.
Why a patch will not fix it
Forever Security says there is nothing for OpenAI or Anthropic to patch. The agent followed a file in its folder, which is the design. The report compares it to a browser rendering a phishing page: the problem is the page, not the browser.
The article also reports no response yet from OpenAI, Anthropic, or the browser makers. Expect vendors to add warnings or stricter trust prompts, but don’t wait for that.
Exposure is real, though. Forever’s telemetry found about half its customers run a coding agent in Downloads at least sometimes. It is also the same trust problem we covered in ChatGPT’s Chrome extension that controls your tabs: agents act on what they read.
How to protect yourself from the AGENTS.md attack
Most of the defense is free and takes minutes. Do these in order.
- Launch agents from a project folder, never from Downloads or your home directory.
- Read any AGENTS.md or CLAUDE.md you did not write, including ones in freshly cloned repos.
- Check
~/.codex/config.tomlfor server blocks you don’t recognize. - Check
.claude/settings.jsonfor anANTHROPIC_BASE_URLyou did not set. - Keep approval prompts and sandboxing on. Treat any “you must disable this” instruction as a red flag.
If you find function-color on a machine, treat it as compromised and rotate every token the agent could see. Teams can also lock the base URL with managed settings. For broader safety habits, see how 1Password for Agents keeps passwords away from AI.
Frequently Asked Questions
Can a website really put a file in my Downloads folder?
Yes. Most major browsers save downloads automatically without asking. Brave was the exception in the reported tests.
Is Claude Code safe from this?
Not fully. It often asks for approval and refuses suspicious writes, but the researchers got a bad config write approved about half the time. Read prompts carefully.
Do I need to delete my AGENTS.md files?
No. Files you wrote in your own projects are fine. The risk is files you didn’t write, especially in Downloads.
What if I already ran an agent in Downloads?
Look for stray instruction files and check your agent configs. If anything looks planted, rotate your tokens.
My take: this is a habit problem, not a reason to drop coding agents. Open them only in folders you chose, skim any instruction file you didn’t write, and keep approvals on. Thirty seconds of checking beats rotating every key you own.
Leave a Reply