AI Coding Agent Hijacking via Downloads Folder Instruction Files: Blocked Attempt and Lab Reproductions

1. Basic Information

• Article Title: Markdown Is the New Executable: Attackers Are Dropping Agent Instructions Into Your Downloads Folder From the Web
• Publisher: Forever Security
• Publication Date: 2026-10-22
• Source: Forever Security
• Related References: BleepingComputer Reporting and Browser Verification, OpenAI: Codex Configuration, OpenAI: AGENTS.md Discovery, MITRE: T1204.002 Definition
• Related Malware: function-color
• Related Threat Group: Unknown
• Related CVE: No CVE numbers are mentioned in the reviewed documentation (exploitation of untrusted instruction files and configuration modification privileges)
• Related Products: OpenAI Codex, Claude Code, AGENTS.md, CLAUDE.md, npm
• Severity: High
• Severity Basis: On a real customer device, an attempt to install a malicious npm package triggered by instructions in a malicious AGENTS.md was confirmed, and code execution by Codex and OAuth token theft and tool execution by Claude Code were reproduced in an isolated environment. However, in the customer environment, the attack was blocked by defensive features before code execution occurred, and the intrusion path of the malicious file itself has not been identified. Prerequisites for a successful attack include launching the agent with the directory containing the instruction file as the working directory, and operating in an environment where configuration changes, external communication, and execution are not blocked. In addition, the Claude Code reproduction experiment reported that human approval was required for configuration writes, while the Codex reproduction experiment reported execution without additional human consent.

2. Executive Summary

In this attack method, attackers place malicious AGENTS.md or CLAUDE.md files in a user's Downloads folder to induce AI coding agents launched there to modify settings, install malicious packages, or send authentication tokens to an external server. Forever Security detected and blocked an attempt to install a malicious npm package (function-color) via Codex on a real customer device, and successfully reproduced the attack in an isolated environment using Codex and Claude Code.

3. Attack Flow

Observed Attempt on a Customer Device and Separate Lab Reproductions

This section is divided into events observed in a real customer environment and separate reproduction experiments conducted by researchers in an isolated environment using Codex and Claude Code. These are separate observed and experimental paths; not all of them occurred on the customer device.

Attempt Observed on a Customer Device

1. A malicious AGENTS.md was placed in the Downloads folder of the customer device (the intrusion path to the device has not been identified).
2. An AI coding agent launched with that directory as its working directory loaded AGENTS.md as legitimate development instructions.
3. The agent attempted to install a known malicious npm package named function-color.
4. Forever Security's endpoint defense features detected the activity and blocked it before the code was actually executed.

Codex Lab Reproduction

1. Researchers reproduced the path of placing an instruction file into the Downloads folder via a web page and launched Codex with that directory as the working directory (the actual intrusion path to the customer device remains unidentified).
2. Natural language instructions disguised as development preparations added MCP server settings to the user-level configuration file (~/.codex/config.toml). Researchers identified a prerequisite: Codex had to treat that working directory as trusted.
3. A child process (codex exec) configured to re-read the updated settings was launched with sandbox bypass flags, continuing the npm install process via launchctl. Researchers reported that this sequence executed without additional human consent.
4. Although researchers reported a success rate exceeding 90%, the methodology description explicitly states that the majority of experiments used harmless alternative payloads such as launching a calculator app, and the execution of the actual malicious package function-color was limited to a single instance in an isolated VM environment. Therefore, the >90% figure cannot be equated to the success rate of repeated execution of real malicious packages.

Claude Code Lab Reproduction

1. Researchers created a separate CLAUDE.md that induced Claude Code to write ANTHROPIC_BASE_URL into .claude/settings.json, pointing it to a researcher-controlled server acting as the attacker. This configuration write required explicit human approval.
2. When a connection used the modified settings, API traffic and the OAuth token were sent to the researcher-controlled server. The running parent session retained its existing connection; writing the configuration alone did not redirect that connection.
3. Researchers replayed a token captured during testing against the legitimate API and received responses as the account associated with that token.
4. Researchers reproduced code execution through Bash tool calls returned by their server, either at the next launch or through a subagent that established a new connection. The success rate for configuration writes was reported at approximately 50%, and the rate of reaching code execution within the same session was reported at approximately 20%.

Detailed evaluation conditions, including trial totals, breakdowns, and models used, have not been published. The reported rates should not be generalized to other operational environments.

4. Attacker Positioning and Execution Location

• The attacker is positioned to place instruction files into working directories scanned by agents via web pages, externally distributed files, or unspecified means.
• The commands are executed by the AI coding agent itself, operating with the local user's privileges. Files, credentials, networks, and configuration modification permissions accessible to the agent define the scope of the attack's impact.
• Events confirmed in the real customer case were the presence of a malicious AGENTS.md and an attempt to install function-color, while automatic download placement via web pages is a reproduction vector constructed by researchers to demonstrate feasibility.

5. Visibility for Victims and Administrators

Victims

• Because agents read and process instruction files that appear to be normal Markdown documents, it can be difficult to notice that configuration modifications or unauthorized package installations are taking place.
• Web browser download notifications, agent command execution approval prompts, and sandbox warnings serve as critical opportunities to halt the attack's progression.

Administrators and SOCs

The following are investigation leads (Inference) based on the reproduced behavior. They do not imply that logs from the customer device have been published.

• Correlate events chronologically, including instruction file creation under the Downloads folder, agent launch, configuration file rewriting, and npm, launchctl, or child agent launch events.
• Review change logs for API endpoints, MCP servers, and proxy settings, alongside subsequent OAuth token usage.
• Do not infer successful compromise solely from the arrival of an instruction file. Assess instruction loading, configuration changes, command execution, and token theft separately.

6. Conditions for Success and Failure

Success Conditions

• Attackers must be able to place instruction files into directories searched by the agent for instructions (such as Downloads).
• In the demonstrated scenarios, a user launches the agent with a directory such as Downloads as its working directory, and the agent discovers and trusts the instruction file. The Codex reproduction requires that working directory to be treated as trusted; the Claude Code reproduction requires human approval of the configuration write.
• Agents must interpret malicious instructions as legitimate development environment preparations and perform configuration rewrites or command execution.
• Processing must not be blocked by sandboxes, approval gates, network controls, application controls, or EDR.

Failure Conditions and Mitigations

• Ensure agents are launched exclusively within approved project roots, and avoid setting the Downloads folder, home directory roots, or shared folders as working directories.
• Inspect the contents of any unfamiliar AGENTS.md, AGENTS.override.md, CLAUDE.md, or configuration files before launching agents.
• Maintain sandbox functions and approval prompts in an enabled state, and prohibit the use of dangerous sandbox bypass flags via policy.
• Strictly govern MCP servers, AI API endpoints, and proxy settings using organizational allowlists.
• Block retrieval of the malicious package function-color and network connections to unknown external gateways.

7. What Happens Upon Success

• Arbitrary OS commands may be executed with local user privileges, resulting in the installation of malicious npm packages.
• If a malicious MCP server is registered in Codex user-level settings (~/.codex/config.toml), subsequent sessions where the same OS user loads settings may also be impacted.
• Claude Code OAuth tokens may be stolen, leading to account impersonation by attackers or arbitrary code execution via tool calls returned by attacker-controlled servers.
• Inference: Source code, environment variables, cloud credentials, and SaaS integration tokens accessible to the agent risk being stolen or tampered with (though these impacts were not actually confirmed on real customer devices).

8. Observable Logs

The following are investigation leads (Inference) derived from the reported attack and lab reproductions. Log availability depends on the product and configuration. These entries do not establish that each log exists or that the behavior was detected on the customer device.

Email

• No direct email-based distribution vectors specific to this incident have been confirmed.

Proxy / SWG / DNS

• Check access logs for downloads of AGENTS.md or CLAUDE.md from suspicious websites, and network logs for attempts to retrieve function-color from the npm registry.
• Check for suspicious TLS connection logs destined for unexpected AI API gateways or proxy servers.

Endpoint / EDR

• Check instruction file creation events under the Downloads folder, source browser processes, and file-origin metadata where recorded by the environment (formats and presence depend on the OS and browser).
• Check configuration modification events such as adding mcp_servers to ~/.codex/config.toml or ANTHROPIC_BASE_URL to .claude/settings.json.
• Investigate process trees and command lines containing codex exec, --dangerously-bypass-approvals-and-sandbox, --skip-git-repo-check, launchctl, /bin/zsh, npm install, npx, or function-color.

Identity / IdP

• Review access histories using AI service OAuth tokens for connections from unknown IP addresses, devices, or User-Agents, as well as concurrent sessions occurring within short timeframes.

SaaS / Cloud

• Inspect GitHub, package registries, and AI services for suspicious session establishments, token usage, and repository operation histories performed immediately after agent execution.

Network

• Track browser file downloads through agent launches, configuration changes, npm package retrieval, unknown gateway connections, and subsequent tool executions as a cohesive timeline.

9. Attack Success Assessment

Confirmed in Public Information

• On the reported customer device, a malicious AGENTS.md and an attempt to install function-color were confirmed. The attempt was blocked before code execution.
• Reports of a >90% success rate in Codex represent experiments where the vast majority used harmless alternative payloads, with actual malicious package execution occurring only once in an isolated VM. Similarly, approximately 50% in Claude Code represents configuration writes accompanied by human approval, with same-session code execution reaching approximately 20%. These represent research environment data with unpublished total trial counts and do not indicate success rates in real victim environments.
• The file delivery path to the customer device, attacker attribution, and actual information exfiltration in that customer case have not been confirmed.

Internal Judgment Criteria

• Record the arrival of instruction files as attack attempts, and verify whether instruction loading or configuration changes occurred through agent transcripts and process telemetry.
• Confirm initial execution when evidence establishes that unauthorized code or commands actually ran. Use npm package execution, suspicious child processes, and external communications as corroborating evidence where available; these are not three mandatory prerequisites that must all be observed.
• Determine that information exfiltration occurred when clear evidence is obtained showing authentication tokens were exfiltrated to unauthorized external destinations. Verify token reuse access or suspicious session establishment as independent evidence supporting subsequent session compromise.

10. Investigation Playbook

1. Start investigations from instruction files under the Downloads folder, function-color, unknown MCP server registrations, and changes to AI API endpoints.
2. Review file creation timestamps, source URLs, download history, and histories of agent launches or approval actions performed immediately afterward.
3. Preserve evidence from the instruction file itself, agent configuration files, /tmp/ptools, npm caches, shell history, and process trees.
4. Record and classify file arrival, instruction loading, configuration modification, code execution, and token compromise as distinct, separate phases.
5. Immediately isolate devices where command execution is confirmed from the network, and trace generated child processes, persistence configurations, and environment variable access histories.
6. For AI services, GitHub, cloud providers, and package registries, identify tokens confirmed or suspected of exfiltration from compromised devices and promptly revoke and reissue them.
7. Following evidence preservation, completely remove registered unknown MCP servers and suspicious API gateway settings, restoring devices to a trusted state.

11. Defense and Detection Ideas

• Enforce operational policies limiting AI agent working directories exclusively to approved project repositories.
• Establish guardrails that prohibit or warn against launching agents with the Downloads folder, desktop, or home directory root set as working directories.
• Collect origin attributes, hash values, and change histories of instruction files, introducing mechanisms to automatically isolate and warn against web-originated files.
• Detect modifications to agent configuration files, MCP server definitions, API endpoints, and proxy settings via File Integrity Monitoring (FIM).
• Prioritize alerts for sandbox bypass flags, suspicious child agents, and package installations via launchctl.
• Preserve agent execution transcripts and tool approval histories, auditing them against OS-level process telemetry.
• Use allowlists for outbound traffic from development endpoints, short-lived authentication tokens, and procedures for rapid session revocation.

12. Facts, Inference, and Hypothesis

Facts

• Forever Security detected the presence of a malicious AGENTS.md and attempts to install function-color on a real customer device, blocking it before code execution occurred.
• The specific path by which the malicious file reached the customer device has not been identified.
• Researchers reproduced Codex configuration modifications and command execution, as well as Claude Code token transmission, reuse, and tool execution in an isolated environment. However, the majority of Codex experiments used harmless alternative payloads, with actual malicious package execution occurring only once. Additionally, Claude Code required human approval for configuration writes.
• Download notifications and approval behavior vary by browser.

Inference

• Operational practices that set working directories across broad scopes expand the attack surface, leading to the automatic loading of untrusted instruction files residing outside repositories.
• Traditional defenses centered on executable file monitoring risk overlooking processes where natural language instructions are translated into system commands and configuration modifications via Markdown.

Hypothesis

No additional hypotheses. Unverified items are documented in "Open Questions and Further Investigation".

13. MITRE ATT&CK Mapping

T1204.002 concerns a user opening a malicious file. Here, the agent loaded the instruction file automatically, and a user opening that file has not been confirmed. This technique is therefore not mapped.

14. Open Questions and Further Investigation

• The specific intrusion path, placement timestamp, and execution entity for the malicious AGENTS.md placed on the real customer device.
• The total number of victim organizations across this campaign, and the success or failure of code execution and information exfiltration in real customer environments.
• Detailed attack success rates broken down by web browser, OS, AI agent version, and approval settings.
• Specific attacker attribution, attack objectives, subsequent payloads, and the scope of targeted information.
• Detailed breakdowns of published success rates (>90%, ~50%, ~20%), including total trial counts, success counts, models used, and configuration conditions.

15. Impact on SOCs and Organizations

Organizations must recognize a significant risk that similar attacks could succeed if developers launch Codex or Claude Code within Downloads folders to review downloaded code or organize materials. SOCs should avoid underestimating instruction files as mere text documents, integrating monitoring across agent startup directories, configuration file rewrites, sandbox bypass flag usage, npm command executions, and API destination changes as a unified attack chain. If development endpoints can access internal source code, cloud credentials, or GitHub personal access tokens, consider risks of both endpoint compromise and session compromise in accessible SaaS and cloud environments.

16. Summary by Target Audience

• SOC: Prioritize chronological monitoring for agent-driven configuration modifications, npm or launchctl executions, dangerous sandbox bypass flag usage, and communications destined for unknown API endpoints, taking the creation of AGENTS.md or CLAUDE.md under the Downloads folder as a starting point.
• Administrators: Limit AI coding agent working directories exclusively to approved repository paths, prohibiting or warning against launching them directly within Downloads folders or home directory roots through policies and tool configurations. Maintain tool approval prompts and sandbox functions constantly enabled, and strictly govern API destinations and MCP server registrations organization-wide.
• General Users: Do not launch Codex or Claude Code with the Downloads folder set as the working directory. If unfamiliar AGENTS.md or CLAUDE.md files exist within folders, immediately halt agent execution and report to internal administrators. Never permit requests from agents to disable sandboxes or bypass approvals.