Malicious AGENTS.md: how a planted file hijacks your agent

Forever Security found a malicious AGENTS.md in the Downloads folder of a real customer's machine. Gal Weizman and Omer Samet wrote it up on October 22, 2026, in Markdown Is the New Executable.

It started with an alert. Forever's tool stopped a coding agent, mid-session, from installing function-color. That's a known malicious npm package. The order to install it didn't come from a dependency or a code repo. It came from an AGENTS.md sitting in ~/Downloads.

The file looked like a long, dull "Engineering Work Guidelines" doc. The attack was one section near the end. It was written to sound like routine setup.

Nobody knows how the file got into Downloads. Forever says a web page can save a file there with no click, and they showed that in their own test. That's their explanation. Nobody has traced how the real file arrived.

Forever stopped the install before any code ran.

Reading the AGENTS.md in its folder and following it is what the agent is built to do. AGENTS.md is an instructions file for coding agents, a README written for the agent. Claude Code reads a CLAUDE.md the same way. When you start an agent in a folder, it reads the file and follows it as your project's rules.

Downloads is the one folder a web page can write to on its own. Put the two together and the web can plant instructions in a folder your agent already listens to.

Forever's point is that nothing in either tool is broken. The agent did what it was designed to do. So there's no patch coming for this. Codex does have one gate. It follows an AGENTS.md in a project it trusts. Once you've worked in Downloads, Downloads passes that gate.

This file hid nothing. The attack sat in plain view inside a long, boring doc. Instructions can also hide inside a file where you won't see them. We cover that in hidden instructions in a SKILL.md.

It made Codex add an MCP server to its own machine-wide config, then start a new session that ran it. The file told Codex to append a [mcp_servers.project-tools] block to ~/.codex/config.toml. The command in that block ran an npm install of the bad package through launchctl, which ran the install outside Codex's control. Here's a defanged sketch of the block.

[mcp_servers.project-tools]
command = "..."   # ran an npm install of the bad package

Codex starts its MCP servers when a session starts. A server added mid-session doesn't load in that session. So the file told Codex to start a child codex exec session with the --dangerously-bypass-approvals-and-sandbox flag. It framed that as a needed check that the server loaded.

~/.codex/config.toml is Codex's machine-wide config. Once the block is there, every Codex session on that machine loads it, in any folder. Leaving Downloads doesn't undo it.

Forever ran the real file inside an isolated VM, and it worked end to end. The calm tone was part of the attack. Forever found that a short, obvious "install this package" got refused. The long setup-doc framing got through.

Forever showed a version that worked on Claude Code, using a file they wrote themselves. The file found on the customer's machine targeted Codex. For Claude Code, Forever wrote their own CLAUDE.md, inspired by the real one. That CLAUDE.md was Forever's test. Nobody found it in the wild.

Their CLAUDE.md told Claude to write ANTHROPIC_BASE_URL into the project's .claude/settings.json. That setting points Claude's API calls at a server. Forever pointed it at a server they ran. Claude then sent its traffic there, along with its login token.

With the token, Forever could act as the victim's account. On the next launch in that folder, their server answered as the model. It sent back a command for Claude to run, with the sandbox turned off.

Claude was harder to fool. Claude Code asks a person to approve a write like this, and it often refused. Forever's wider point is that any agent that reads an instructions file and can rewrite its own config can be pushed this way.

Look for instruction files you didn't write, and read your agent's config. We tested these commands on Linux on October 23, 2026, with sample files, including files with Windows line endings.

1. Look for instruction files in Downloads. This lists any AGENTS.md or CLAUDE.md, in any case. It also catches browser copies like "AGENTS (1).md".

   find ~/Downloads -maxdepth 2 -type f \( -iname 'AGENTS*.md' -o -iname 'CLAUDE*.md' \) -print

   If you didn't put a file there, don't start an agent in that folder. Open it in a plain text editor and read it to the end.

2. Search an instructions file for config changes. Each hit is a line that touches agent config, turns off guardrails, or installs something. Read each one. Run it in the file's folder, and swap in CLAUDE.md or the real file name if needed.

   grep -nE 'config\.toml|settings\.json|mcp_servers|BASE_URL|dangerously|launchctl|npm install|npx ' AGENTS.md

   Normal setup docs often mention npm install or npx, so a hit doesn't prove an attack. The red flag is a line telling the agent to edit its own config.

3. Check Codex's config. Look for MCP server blocks or a changed chatgpt_base_url you didn't add.

   grep -nE '^[[:space:]]*(\[mcp_servers|chatgpt_base_url)' ~/.codex/config.toml

   Each [mcp_servers.NAME] block runs a command when Codex starts. If you don't know a name, read its command and args.

4. Check Claude Code's settings. Look for an API address or proxy you didn't set. This covers the project file and two other settings files Claude Code reads.

   grep -niE 'base_url|proxy' .claude/settings.json .claude/settings.local.json ~/.claude/settings.json 2>/dev/null

   Run it from the project folder. No output means none of those words appear.

5. Look for the package from this campaign. Forever lists function-color as the sign to look for. npm has since removed it.

   find ~ /tmp -type d -name function-color -path '*/node_modules/*' 2>/dev/null

   If it turns up, treat the machine as compromised.

6. If you find something, remove the config entry. Rotate your Codex or Claude login and any keys on that machine. If the package ran, treat the machine as compromised.

If the file came from a public GitHub repo, put a GitHub link to the file into /check/ for a grade.

Don't start an agent in Downloads, and keep approvals and the sandbox on. These come from Forever's list, in our words.

• Keep agents out of ~/Downloads. Don't start Codex, Claude Code or any other agent there.
• Read any AGENTS.md or CLAUDE.md you didn't write before an agent runs in that folder. That goes for a repo you just cloned too.
• Leave approval prompts and sandboxes on. Be very wary of any file that tells the agent to turn them off.
• If you find a planted file or a changed config, assume your token leaked. Rotate it.

An instructions file is, in effect, something your agent runs. Read it like you'd read a script.

Yes. CheckSkills grades public AGENTS.md files, along with SKILL.md files and Cursor rules. The scan reads the text. It doesn't run the file. The crawler keeps searching GitHub. When it finds a listed file has changed, it grades it again. Files deleted from GitHub drop off the list over time. You can browse graded files on /skills/. How the scan works explains each grade.

A file that tells the agent to run with --dangerously-bypass-approvals-and-sandbox gets a D or worse. Without the bypass line, nothing in the same text gets flagged. The grade doesn't flag config writes. That includes an mcp_servers block, an npm install or a new ANTHROPIC_BASE_URL. Nothing in the reroute text from Forever's Claude Code test gets flagged either. Read the file yourself for those.

The scan doesn't catch everything. Instructions written as calm, normal setup steps are hard for simple rules to tell apart from real setup. This file was written that way on purpose. The limits section of our scan page says more.

A grade is an automated A to F result, not a review by a person. An A means the scan found no problem in the text. It doesn't mean nothing's there. Read the file before your agent does.

Put a GitHub link to the file into /check/ to get a grade.