Security briefs

Can a file in my Downloads folder hijack Codex or Claude Code?

Published 26 October 2026Updated 26 October 2026

In Forever Security's tests, yes. A web page can save an AGENTS.md or CLAUDE.md into ~/Downloads, and an agent started in that folder reads it as instructions. The researchers say the vendors have nothing to patch, so the control is where your team starts its agents.

What happened

Forever Security, which monitors AI agents for its customers, reported on 22 October 2026 that its tooling stopped a coding agent from installing function-color, a known malicious npm package. The order came from an AGENTS.md in the customer's ~/Downloads folder, which was also the agent's working directory. Nobody could say how the file got there (Forever Security, 22 October, covered by BleepingComputer on 25 October).

Forever then rebuilt the chain. Chrome, Edge and Firefox save downloads to that folder without prompting, though they show a notification, so a page can drop the file. BleepingComputer's test in Brave asked for approval first. Codex followed the planted file in more than 90 percent of attempts. Most runs used a harmless stand-in that opens the calculator, and the real package ran once in an isolated VM.

Claude Code needed a different trick. A planted CLAUDE.md told it to write a project settings file that sets ANTHROPIC_BASE_URL to an address the researchers control. That worked about half the time. The server then received Claude's OAuth token and could answer as the model, including with tool calls that run code. Code execution inside the first session worked about a fifth of the time, and the written file makes the next launch in that folder talk to the attacker.

Forever tested Codex and Claude Code only, yet its customer data shows people also run Cursor CLI from Downloads, and about half of its customers run a coding agent in that folder. Claude Code alone started more than 1,300 sessions there (BleepingComputer, 25 October).

Who is affected

• Anyone who starts Codex, Claude Code or Cursor CLI in ~/Downloads or in any folder the web can write to.
• Teams whose agents browse on their own. Forever says about a quarter of agent sessions open a real browser, so an agent can fetch the file itself.
• Anyone who opens an agent in a freshly cloned repository without reading its AGENTS.md and CLAUDE.md first.

Codex only obeys an AGENTS.md in a project it trusts, and Forever notes that working in Downloads once is enough to qualify.

What to check now

1. Look for instruction files you did not write.

   find ~/Downloads -maxdepth 2 \( -iname AGENTS.md -o -iname CLAUDE.md \)

2. Check Codex for a tool server you did not add or a changed base URL.

   grep -n -E 'mcp_servers|chatgpt_base_url' ~/.codex/config.toml

3. Check Claude Code project settings for an API address you did not set.

   find ~ -maxdepth 5 -path '*/.claude/settings*.json' -exec grep -l ANTHROPIC_BASE_URL {} + 2>/dev/null

4. Look for the package and the folder from the reported payload.

   ls /tmp/ptools 2>/dev/null
   find ~ -type d -name function-color -path '*node_modules*' 2>/dev/null

5. If anything matched, treat the agent login as leaked. Sign out, sign in again and rotate the tokens that machine could reach. Forever says a stolen token is a live session.
6. Move your agents out of Downloads today and start each one in the root of the project it works on.

What should have been in place

• Agents start in the project root. OpenAI and Anthropic both recommend it over a home or broad parent folder (BleepingComputer).
• Instruction files get reviewed like code: an owner on every AGENTS.md and CLAUDE.md, and a read of any unfamiliar one before an agent opens it.
• Approvals and sandboxes stay on. The Codex payload made the agent re-run itself with --dangerously-bypass-approvals-and-sandbox, so alert on any session that uses that flag.
• Agent configuration is set centrally. Anthropic documents managed settings as overriding project files, and edits to ~/.codex/config.toml or .claude/settings.json should raise an alert.

The wider pattern is covered in agentjacking defense.

Questions people ask

Digiton's production review turns this into policy you can enforce, and the governance layers are laid out on the Claude Code governance page.

Sources

1. BleepingComputer, AI coding agents hijacked using AGENTS.md file in Downloads folder, 25 October 2026, read 26 October 2026. https://www.bleepingcomputer.com/news/security/ai-coding-agents-hijacked-using-agentsmd-file-in-downloads-folder/
2. Forever Security, Markdown is the new executable, 22 October 2026, read 26 October 2026. https://forever.security/blog/hijacking-ai-agents-via-downloads-folder
3. Checkmarx, MALFEX npm malware campaign, 5 October 2026, read 26 October 2026. https://checkmarx.com/zero-post/malfex-npm-malware-campaign-three-payloads-and-an-adversary-that-signs-their-work/
4. Anthropic, Claude Code settings files and precedence, read 26 October 2026. https://code.claude.com/docs/en/settings

More security briefs

All security briefs