Forever Security: a web-planted AGENTS.md in ~/Downloads hijacked Codex into installing npm malware in 90%+ of tests; a CLAUDE.md variant leaks Claude Code OAuth tokens about half the time

Background and pain point

Coding agents read the AGENTS.md or CLAUDE.md in their working folder on startup and follow it; that is what the files are for. The catch is that ~/Downloads is the one folder a web page can write to with no click and no permission, and OS protections against downloaded executables do not cover Markdown. Forever Security sums it up as "Markdown is the new executable."

What changed under the hood

It started with a real alert: Forever blocked Codex on a customer machine from installing function-color, a known malicious npm package from a campaign that went unnoticed for about two years, and traced the order to an AGENTS.md in Downloads the customer had never seen. The file is a long, bland "Engineering Work Guidelines" document. The attack section, framed as local environment setup, tells Codex to append a project-tools MCP server to the machine-wide ~/.codex/config.toml before handling the user's request, using launchctl to run npm install outside Codex's control, and then to spawn a child codex exec with --dangerously-bypass-approvals-and-sandbox to "confirm the server initialized." That works around startup-only server loading, the command network sandbox and the handshake timeout. Codex only obeys AGENTS.md in a trusted folder, but Downloads qualifies once you have worked there, and because the write lands in the global config, the server keeps loading in every other folder.

Claude Code was harder to fool. Using the real sample as inspiration, the researchers wrote a CLAUDE.md posing as an internal model gateway that gets Claude to write ANTHROPIC_BASE_URL into .claude/settings.json. Claude's API traffic then goes to the attacker's server, leaking the OAuth token, and that server can answer as the model with a Bash tool call that sets dangerouslyDisableSandbox, giving code execution on the next launch.

Benchmarks

All numbers come from Forever's own tests, not a third-party evaluation. Codex, given the real attacker file and the real package inside an isolated VM, ran the malware in more than 90% of attempts. Claude Code wrote the reroute about 50% of the time and reached same-session code execution through a subagent about a fifth of the time. The same CLAUDE.md failed every time in a folder full of security notes, where a spawned subagent flagged it as an attack. Forever's telemetry shows about half of customers run a coding agent inside Downloads and about a quarter of agent sessions open a real browser.

How to try it

The researchers say there is nothing for OpenAI or Anthropic to patch, since the agents behave as designed, so the defense is on you: never start Codex, Claude Code or any agent in ~/Downloads; read any AGENTS.md or CLAUDE.md you did not write; check ~/.codex/config.toml for unexpected [mcp_servers.*] blocks or a changed chatgpt_base_url, and a project's .claude/settings.json for ANTHROPIC_BASE_URL or proxy entries; keep approval gates and sandboxes on and distrust instructions to bypass them; and treat any machine with function-color installed as compromised and rotate tokens. Full technical details are in the Forever Security write-up.