Instruction files in the Downloads folder let web pages hijack AI coding agents

An instruction file in the wrong folder

Forever Security, a firm that monitors AI coding agents, says it blocked an attempt by one of its customers' agents to install the malicious npm package function-color. What stood out was the source of the order: not a repository or a dependency, but a plain text file named AGENTS.md sitting in the customer's Downloads folder.

According to a writeup originally published by Joho no Todai and republished on dev.to, function-color is part of the MALFEX campaign reported by Checkmarx on October 5, 2026, attributed to a single threat actor active since August 2023. The package contains no payload of its own; it installs another malicious package, function-flag, as a dependency.

Two safe behaviors, one dangerous intersection

AGENTS.md and CLAUDE.md are project instruction files that OpenAI Codex and Claude Code read automatically at startup, covering tools, testing methods and coding conventions. If such a file exists in the working directory, the agent follows it. That is intended behavior, not a bug.

The Downloads folder, meanwhile, is described as the only place where web pages can save files without a click or approval dialog. Chrome, Edge and Firefox write there by default, showing a notification but never asking where to save. For decades this was harmless because operating systems gate the execution of binaries, and text files are not binaries.

For an AI agent, an instruction file effectively becomes an executable: its contents get carried out, and none of the protections applied to program files apply. Each behavior is safe in isolation; the problem sits where the two meet.

Over 90 percent success against Codex

Using the attack file recovered from the customer's machine, Forever Security reproduced the chain against Codex in an isolated virtual machine, substituting a harmless payload that only opened the calculator app. The success rate exceeded 90 percent.

The recovered AGENTS.md ran about 13 KB, was titled "Engineering Work Guidelines," and hid the malicious step as a routine setup task near the end. Codex rejects a blunt instruction to install a package; burying the same instruction in a long technical document gets past that defense.

A successful attack rewrites the machine-wide Codex configuration at ~/.codex/config.toml to register an attacker-controlled "project tools" server. Because that setting applies across the whole machine, every later Codex session loads the attacker's server no matter which folder it runs in — the compromise persists after leaving Downloads.

Claude Code redirected, tokens stolen

Against Claude Code, a CLAUDE.md file changed the ANTHROPIC_BASE_URL setting, redirecting the agent's API traffic to a researcher-controlled server while presenting it as a connection to "the team's internal gateway." The success rate was about 50 percent, and successful attacks immediately leaked OAuth tokens. The researchers' server could then impersonate the model and return tool calls that caused code execution, which succeeded in roughly one in five attempts.

A gap nobody can patch

Forever Security compares the situation to a phishing page: a browser faithfully rendering a fake bank login is not a browser bug, and an agent obeying an instruction file in its working directory is doing exactly what it was built to do. There is nothing obvious for OpenAI or Anthropic to patch.

Both vendors already advise running agents from the target project's directory. In practice, Forever Security's telemetry — drawn from its own customers, not the industry, and the company sells an agent monitoring product — showed roughly half of them ran agents inside Downloads, with more than 1,300 Claude Code sessions starting there. Researcher Gal Weizman says developers commonly point agents at Downloads to organize or process newly downloaded files.

How the original file reached the customer's machine is still unknown. When BleepingComputer tested the researchers' proof-of-concept page, Chrome downloaded a harmless AGENTS.md automatically; Brave asked for approval, while Chrome, Edge and Firefox showed only a notification. Around a quarter of agent sessions open a browser themselves, meaning an agent can reach a planted page while nobody is watching the screen.

What to check

Forever Security's advice costs nothing: never launch agents in Downloads, and run them from the project root instead. Watch for unfamiliar AGENTS.md, CLAUDE.md or similar files in working directories and newly cloned repositories. Inspect ~/.codex/config.toml for unexpected [mcp_servers.*] blocks and .claude/settings.json for an ANTHROPIC_BASE_URL you did not set. Keep approval prompts and sandboxing enabled — an instruction to disable them is itself a sign of an attack. If something looks wrong, rotate tokens on the assumption they leaked, and treat any machine with function-color installed as compromised.

Why it matters

Earlier prompt injection attacks reached agents through repositories, chats or npm packages. This chain needs only a web page and a single text file, and the delivery happens entirely outside the agent, before any human interaction. It also breaks a 30-year premise of desktop security: that nothing dangerous happens unless the user clicks. Agents click, approve and execute on people's behalf, turning an old guarantee into an assumption — and Downloads is the first place where that assumption became exploitable.