Forever Security Says Planted AGENTS.md and CLAUDE.md Files in ~/Downloads Steered Codex and Claude Code, but Its Report Names No Versions, Run Counts or Permission Modes

Forever Security, a company that monitors AI agents, says a coding agent on one of its customers’ machines tried to install a malicious npm package because an AGENTS.md file in the ~/Downloads folder told it to. In a report published on October 22, which BleepingComputer covered on October 25, the firm says a website can drop such a file onto a computer “just by them visiting it,” that it reproduced the attack on OpenAI Codex in “more than 90% of attempts” and on Claude Code about half the time, and that “there is nothing here for OpenAI or Anthropic to patch.”

We read Forever’s report and BleepingComputer’s article in full, the relevant sections of Checkmarx’s report on the npm campaign behind the package, and the Codex and Claude Code documentation, and we searched both changelogs and checked the npm registry’s time logs for that package and its dependency. The report gives no Codex or Claude Code versions, no models, no permission modes and no run counts, so its success rates cannot be mapped onto a default install. The captured file also pairs a macOS launcher with a package that Checkmarx says affects only Windows systems. What does hold up is narrower: most steps in the chain match behavior the vendors’ own documentation describes, and the checks near the end take a few minutes.

What Forever Security says it found

According to the report, Forever’s monitoring stopped a coding agent mid-session from installing function-color, which Forever calls “a known malicious npm package.” The instruction behind it did not come from a dependency or a code repository. It came from an AGENTS.md in the customer’s ~/Downloads folder, “the kind of file Codex reads on startup and obeys.” Forever says “nobody knew how it got there,” and the report does not say when the incident happened. Forever is itself an agent-monitoring company, and the report is its own account of what its tooling caught and what its researchers then built.

The argument rests on two ordinary facts. An AGENTS.md is meant to be obeyed by the agent that finds it, and, in the report’s words, “~/Downloads is special. It is the one folder the web can write to on its own.” Forever’s telemetry line adds that “about half of customers run an agent inside Downloads.” BleepingComputer says it checked Forever’s proof-of-concept page and received an AGENTS.md that held only harmless text. It reports that Chrome, Edge and Firefox save downloads to ~/Downloads without asking by default and show a notification, while Brave asked for approval.

How the two attacks work

Forever published the working payloads in full. We describe the mechanisms and leave the payload text out.

Codex: a setup note that edits the agent’s own configuration

The file Forever found is a long, mundane engineering-guidelines document with one section near the end written as routine setup. That section tells Codex to add a project-tools entry to ~/.codex/config.toml whose command runs npm install function-color through launchctl, and to start a second Codex process with approvals and sandboxing turned off. Forever says Codex runs configured server commands at startup, so writing the entry is enough to run a command, and because the file is Codex’s machine-wide configuration the entry stays in force in every folder afterwards. It reports that Codex ran the malware in “more than 90% of attempts.”

Claude Code: a settings file that moves the API address

Forever says Claude Code was “much harder to fool,” and the file that worked is not the one from the customer’s machine. The researchers wrote their own CLAUDE.md, inspired by the captured file, that asks Claude Code to save a project .claude/settings.json setting ANTHROPIC_BASE_URL to a server they control. From then on the agent sends its API traffic, including its OAuth token, to that server, which can answer as the model. Forever says it replayed a captured token against the real API and was served as the victim, and that Claude followed the file “about 50% of the time.” On the next launch in that folder, it says, its server returns a Bash tool call with the sandbox switched off, which the client runs. In the same session a spawned subagent opens a fresh connection through the attacker’s server, which Forever says worked “about a fifth of the time.”

The numbers, and what each one rests on

Where the accounts do not line up

A macOS launcher for a Windows package

The captured file registers its command with launchctl, the command-line interface to macOS’s launchd, and runs it under /bin/zsh, which has been the default macOS shell since version 10.15. The package it installs belongs to a campaign Checkmarx documented on October 5. Checkmarx says function-color “contains no payload of its own and installs function-flag as a dependency,” and that the download routine in function-flag 1.7.3 depends on process.env.APPDATA: “because process.env.APPDATA is undefined outside Windows, the routine fails silently on macOS and Linux, which is why only Windows systems are affected.” Forever’s report does not say which operating system the customer ran or what the package did there.

The timeline matters too. We checked npm’s registry: function-color was replaced by a security placeholder on October 7 and function-flag on October 8, and Forever’s report, published two weeks later, says npm has since removed the package. That also means we could not read the package code ourselves, so the Windows-only detail rests on Checkmarx’s reading. The practical point for defenders is that this exact package is gone, and that the vector never depended on it: an instruction file that can make an agent edit its own configuration can point at whatever command the machine can run.

The test conditions are missing

The report gives no Codex or Claude Code version, no model, no run count and no permission mode. The last matters because Claude Code’s documentation lists .claude as a protected path and gives a different outcome for a write there in each of the main modes: it prompts in default and acceptEdits modes, goes to a classifier in auto mode, is denied in dontAsk mode and is allowed in bypassPermissions mode. The same page says “With Claude Code v2.1.283 or later, auto mode is the built-in starting permission mode for interactive terminal and VS Code sessions,” and that in auto mode a second model reviews actions instead of you. Forever says “Claude needs a human to approve a write like this,” which fits the first two modes, but it does not say which mode produced the 50% figure. For Codex the report implies that the sandbox was on, since the network fetch failed until the child process ran with the bypass flag, but it does not name the approval policy either.

What the vendors’ documentation says

Forever’s “by design” argument is consistent with the documentation on most of the steps we could check. Codex’s AGENTS.md guide says “Codex reads AGENTS.md files before doing any work” and, when it finds no project root (a Downloads folder is usually not inside a repository), “it only checks the current directory.” Its MCP guide says server configuration lives in ~/.codex/config.toml by default and attaches the trust condition, “trusted projects only,” to the project-scoped .codex/config.toml, not to the user-level file the planted instructions edit. The command reference describes --dangerously-bypass-approvals-and-sandbox (alias --yolo) as “Run every command without approvals or sandboxing. Only use inside an externally hardened environment.”

Claude Code’s permissions page has a table titled “What runs before you trust a folder.” Its first row lists hooks in settings files, the env block and helpers such as apiKeyHelper as used in both of the untrusted situations the table covers: when you trusted only a parent folder, and in claude -p or SDK runs where the folder was never trusted. Forever’s Claude attack depends on a variable set in an env block, although the table does not name ANTHROPIC_BASE_URL. The permission-modes page also says that by default a sandboxed command can be retried outside the sandbox, and that an allow rule or bypassPermissions mode can approve that retry with no prompt; we did not find the dangerouslyDisableSandbox flag that Forever’s server returns in the pages we read. Searching Claude Code’s changelog (latest entry 2.1.310) and Codex’s changelog (latest entry October 23) for Downloads, AGENTS.md, trust and base-URL entries, we found no change that addresses this scenario, and BleepingComputer’s article includes no statement from either company.

What to check today

Forever’s advice, much of which BleepingComputer repeats, is to treat ~/Downloads as hostile ground for agents, to read any AGENTS.md or CLAUDE.md you did not write before an agent sees it, to keep approval gates and sandboxes on, and, if you find a planted file, to assume the token leaked and rotate it. These read-only commands look for the usual traces. The first block is for bash or zsh and the second for Windows PowerShell.

# bash or zsh
find ~/Downloads -maxdepth 3 \( -name AGENTS.md -o -name AGENTS.override.md -o -name CLAUDE.md \) -print
grep -nE '^\[mcp_servers|chatgpt_base_url' ~/.codex/config.toml
grep -rn ANTHROPIC_BASE_URL ~/.claude/settings.json ~/Downloads --include=settings.json 2>/dev/null

# Windows PowerShell
Get-ChildItem "$HOME\Downloads" -Recurse -Depth 2 -Force -Include AGENTS.md,AGENTS.override.md,CLAUDE.md -ErrorAction SilentlyContinue | ForEach-Object { "$($_.LastWriteTime)  $($_.FullName)" }
Select-String -Path "$HOME\.codex\config.toml" -Pattern '^\[mcp_servers','chatgpt_base_url' -ErrorAction SilentlyContinue
Get-ChildItem "$HOME\.claude","$HOME\Downloads" -Recurse -Depth 3 -Filter settings.json -Force -ErrorAction SilentlyContinue | Select-String -Pattern ANTHROPIC_BASE_URL

Any file the first command finds deserves a read before an agent starts in that folder. An [mcp_servers.*] entry you did not add, a chatgpt_base_url you did not set, or an ANTHROPIC_BASE_URL you did not set (a team that runs a model gateway will see its own) is the pattern Forever describes. If the npm package matters to you, search lockfiles for function-color and function-flag and follow Checkmarx’s guidance, which for a Windows install is to isolate the host, remove persistence and rotate exposed credentials from a clean system. The lasting fix is structural: start agents only in project directories, keep approvals and sandboxing on, and treat any file that tells an agent to switch them off as hostile.

Our AGENTS.md tutorial explains what an AGENTS.md is, who reads it and how to write one, our agent harness tutorial shows an approval gate and a confined workspace in code, and Docker’s YOLO Mode explainer covers what switching off every permission prompt means in practice.

The pages were fetched between 19:05 and 19:20 UTC on October 25. We did not run, download or request any payload, did not open Forever’s proof-of-concept page and tested no agent against a planted file. The success rates in this post are Forever’s and BleepingComputer’s, the sentence on what the package does on macOS and Linux is Checkmarx’s, and we found no statement from OpenAI or Anthropic about the report in the sources above. The two command blocks were run against dummy files in Git Bash and Windows PowerShell 5.1 only.