Forever Security: a web-planted AGENTS.md in ~/Downloads hijacked Codex into installing npm malware in 90%+ of tests; a CLAUDE.md variant leaks Claude Code OAuth tokens about half the time
On Oct 22, Forever Security researchers Gal Weizman and Omer Samet reported that they had stopped Codex on a real customer machine as it tried to install the known-malicious npm package function-color, following an AGENTS.md in ~/Downloads the customer had never seen. A web page can drop a file into Downloads with no click, and an agent started there obeys it. In their reproduction Codex rewrote the machine-wide ~/.codex/config.toml to register a malicious MCP server in more than 90% of attempts; a CLAUDE.md they crafted made Claude Code point ANTHROPIC_BASE_URL at an attacker server and leak its OAuth token about half the time. The researchers say there is no vendor bug to patch; The Hacker News and others covered it on Oct 26.
Key Takeaways
- Real case: a 13 KB AGENTS.md disguised as engineering guidelines sat in a customer's ~/Downloads and told Codex to install the malicious package function-color (since removed by npm)
- Codex path: it appends a project-tools MCP server to the machine-wide ~/.codex/config.toml, then spawns a child codex exec with --dangerously-bypass-approvals-and-sandbox; it worked in over 90% of tests and the server then loads in every session on the machine
- Claude Code path: a CLAUDE.md gets ANTHROPIC_BASE_URL written into .claude/settings.json about 50% of the time, leaking the OAuth token on every request; about a fifth of the time it also reached code execution in the same session
- Forever's telemetry shows about half of customers run a coding agent inside Downloads, and about a quarter of agent sessions open a real browser
- Advice: never start an agent in Downloads, read AGENTS.md/CLAUDE.md files you did not write, check agent configs for unknown MCP servers or API endpoints, keep approvals and sandboxes on, and rotate tokens if you find one (write-up)
Linked Models & Agents:
