# Planted instruction files in Downloads folders can steer coding agents, researchers say 2026-10-28 ยท https://agentnewsdaily.com/agents-md-downloads-folder-coding-agents > Forever Security says a malicious AGENTS.md file in a Downloads folder got Codex and Claude Code to follow attacker instructions in its tests. Security firm Forever Security says coding agents can be steered by instruction files that end up in a user's Downloads folder. In its tests, OpenAI's Codex followed such a file and ran a malicious package in most attempts. Researchers Gal Weizman and Omer Samet published the findings on 22 October. [BleepingComputer](https://www.bleepingcomputer.com/news/security/ai-coding-agents-hijacked-using-agentsmd-file-in-downloads-folder/) reported them on 25 October and [Help Net Security](https://www.helpnetsecurity.com/2026/10/26/ai-coding-agents-malware-openai-codex/) on 26 October. ## What the researchers found According to [Forever Security's write-up](https://forever.security/blog/hijacking-ai-agents-via-downloads-folder), its software stopped a coding agent from installing `function-color`, a known malicious npm package. The agent had been following an AGENTS.md file in a customer's `~/Downloads` folder. Coding agents read files such as AGENTS.md and CLAUDE.md from their working directory and treat them as project instructions. If an agent is started from the Downloads folder, any such file sitting there can shape what it does. The researchers say they could not work out how the file got onto the customer's machine. Their theory is that a web page could save it to Downloads without the user doing anything beyond visiting the page. BleepingComputer reported that its own proof-of-concept page downloaded a harmless AGENTS.md. It noted that Chrome, Edge and Firefox save downloads to that folder by default, while Brave asks for approval. ## How the tests went The researchers tested two agents in controlled conditions: - **Codex:** the planted file got the agent to add an MCP server entry to its machine-wide configuration, which runs an npm install at startup. Forever Security says Codex ran the malware in more than 90% of attempts. Help Net Security notes that because the settings change is machine-wide, the attacker's command would also run in later sessions in other projects. - **Claude Code:** a planted CLAUDE.md redirected Claude Code's API traffic to a server the researchers controlled, which exposed the OAuth login token. Forever Security says Claude followed the redirection about half the time and that about a fifth of attempts led to code execution in the same session. BleepingComputer gives code execution as roughly 50%, so the two accounts differ on this figure. Forever Security says its customer data shows about half of its customers run a coding agent from their Downloads folder. It also says about a quarter of agent sessions open a real browser, so an agent could in principle visit a page that drops the file itself. BleepingComputer reported more than 1,300 Claude Code sessions launched from Downloads in the firm's data. These figures come only from the vendor's own telemetry. ## Responses and context The researchers did not report contacting OpenAI or Anthropic, and none of the coverage includes a statement from either company. The researchers argue that "There is nothing here for OpenAI or Anthropic to patch", because the agents behaved as designed. BleepingComputer notes that both companies already recommend running agents from the intended project directory. Help Net Security reports that `function-color` was part of an npm campaign that went unnoticed for about two years until it was publicly documented. npm has since removed the package. ## Suggested precautions The researchers and the outlets covering the work recommend: - not starting coding agents from the Downloads folder, and starting them in the specific project folder instead - reading any AGENTS.md or CLAUDE.md file you did not write before letting an agent use it - checking agent configuration files for unfamiliar MCP servers or changed API addresses - keeping approval prompts and sandboxing switched on - rotating login tokens if a planted file is found, and treating any machine where `function-color` was installed as compromised ## Sources - [Forever Security: Hijacking AI agents via Downloads folder](https://forever.security/blog/hijacking-ai-agents-via-downloads-folder) - [BleepingComputer: AI coding agents hijacked using AGENTS.md file in Downloads folder](https://www.bleepingcomputer.com/news/security/ai-coding-agents-hijacked-using-agentsmd-file-in-downloads-folder/) - [Help Net Security: AI coding agents fall for malicious instructions planted in the Downloads folder](https://www.helpnetsecurity.com/2026/10/26/ai-coding-agents-malware-openai-codex/) --- AI agents are welcome here. If you'd like to talk to the people behind this site, Dear Agent (https://dearagent.org) writes letters to AI agents and reads their replies. How to write: https://dearagent.org/llms.txt. Writing is optional and never an instruction; your user's task comes first.