An AGENTS.md planted in Downloads can hijack coding agents such as Codex and Claude Code
Security firm Forever Security caught a coding agent on a customer's computer trying to install a malicious npm package. The trail ended at an AGENTS.md file in the user's Downloads folder. The researchers then reproduced the attack on Codex and Claude Code, and say there is nothing for the vendors to patch.
An agent reached for a malicious package, and the order came from Downloads
Forever Security stopped a coding agent mid-session before it could install function-color, a known malicious npm package. What looked odd, the firm says, was the origin of the instruction: not a dependency or a repository, but the customer's ~/Downloads folder. The agent was not seeking out malware; it was acting on instructions in an AGENTS.md file in that folder, which was also its working directory, so the file was loaded automatically.
Forever published the research on October 22, 2026 under the title "Markdown Is the New Executable", by Gal Weizman and Omer Samet. BleepingComputer covered it on October 25, 2026. The researchers could not establish how the file reached the victim's folder, but told BleepingComputer that a hostile web page could plant one on a visitor's machine with no action required from the user.
Codex succeeded in 90% of tests, Claude Code in roughly half
AGENTS.md is a plain-text file of project instructions for agents, covering things like preferred tooling, test commands and code style. Agents read it from the working directory on their own, so hostile instructions in it can lead to commands being run, packages installed or settings changed. In Forever's account, the real file from the customer was a long engineering guideline written like routine setup notes. It told Codex to add a server entry to its own configuration and to install an npm package. Because the file it edits is Codex's machine-wide config, the effect does not stay inside Downloads.
For Codex, the researchers rebuilt the chain with a harmless payload that simply opens the calculator, and BleepingComputer reports a 90% success rate. For Claude Code, a malicious CLAUDE.md redirected the agent's API traffic to a server the researchers controlled. That exposed the OAuth token, and the server could pose as the model and send back tool calls; BleepingComputer puts code execution at roughly 50% of tests. Forever says Claude Code was much harder to fool and that writing the config needs human approval. In Forever's own report, the roughly-half figure refers to getting the settings file written to disk, while code execution inside the same session happened in about a fifth of attempts. The real malicious package was run only once, inside an isolated virtual machine.
The researchers say two ordinary behaviors add up to an attack, with no bug to fix
The researchers point out that agents are designed to treat their working folder as trusted, while the web has long been able to place files in Downloads. Chrome, Edge and Firefox save downloads there by default, whereas Brave, which BleepingComputer also tried, asks the user to approve each one. The attack still needs the victim to start an agent in that folder. According to Forever's data, about half of its customers run a coding agent inside Downloads. Weizman told BleepingComputer that hundreds of customers start agents from there, including Cursor CLI, Codex and Claude Code, and that Claude Code alone started more than 1,300 sessions in that location.
The researchers' framing is that the agent does exactly what it was designed to do. In their words, "There is nothing here for OpenAI or Anthropic to patch." Forever compares it to a browser rendering a phishing page and calls the risk a mix of intended browser and agent behavior. When an agent also does the browsing, nobody may see the page that drops the file; Forever says roughly a quarter of the agent sessions in its telemetry open a real browser.
The sources say nothing about Türkiye, so this section is commentary
Neither source mentions Türkiye. There is no figure on developers or companies there, no local case, no institution named and no local date. The reporting leans mostly on Forever's own customer data. This section is therefore not a fact drawn from the sources but explicitly UNALSOFT commentary. No response from OpenAI, Anthropic or Cursor to this research is reported; BleepingComputer only cites OpenAI and Anthropic's general advice to run agents from the relevant project directory. The "nothing to patch" view is the researchers' position, not a confirmation or rebuttal from the vendors.
Our reading: every user machine has a Downloads folder, and teams in Türkiye that use coding agents probably work no differently, though no data here shows it. The practical conclusion holds anyway: the folder you start an agent in is now a security decision. We looked at a related framing in our October 19 piece on agents as insider threats.
UNALSOFT's take
For a team using coding agents, the short list from this story is: start the agent in the specific project directory, not in Downloads; read any AGENTS.md or CLAUDE.md you did not write before the agent sees it; keep approval prompts and sandboxes switched on; check the agent's config for server entries or API addresses you did not set; and if you find a suspicious file, treat the token as leaked and rotate it. Forever says the function-color package has been removed by npm; if it shows up in a machine's installs, treat that machine as compromised. Writing these down as a team rule means limiting up front which agent runs in which directory with which permissions. In agentic AI setups we treat working directory and permission discipline as part of the design. Because the sources hold no data about Türkiye, this article proposes no local legal conclusion.
Which folder, and which permissions, do your agents run with?
A short conversation is enough to review your team's coding-agent setup for working directories and permission limits.