Keep coding agents out of your Downloads

What changed

Your Downloads folder is the one place a website can leave a file, and your agent may obey it. Coding agents automatically read instruction files like AGENTS.md or CLAUDE.md in the folder you start them in and follow what they say.

What was found

Forever Security stopped a coding agent mid-session as it tried to install function-color, a known malicious npm package that npm has since removed. The order came from an AGENTS.md file in the customer’s ~/Downloads folder, written as long, ordinary-looking engineering notes. Nobody knew how it got there.

The researchers say a web page can save a file into Downloads with no click, and they built a demo page that does it. BleepingComputer notes that Chrome, Edge and Firefox save downloads there without asking, but show a download notification by default.

How the attack plays out

• Codex: the planted file gets the agent to add a “project tools” server to ~/.codex/config.toml, which installs the package. That config applies machine-wide, so every later Codex session loads it. Forever reports the attack ran in more than 90% of its attempts, mostly with a harmless stand-in that just opens a calculator.
• Claude Code: in the researchers’ test, a CLAUDE.md they wrote gets Claude to point its API traffic at the attacker’s server through .claude/settings.json. That leaks Claude’s login token and can lead to running the attacker’s code. Forever reports it worked about half the time.

OpenAI and Anthropic have nothing to fix here, the researchers say, so protecting yourself is up to you.

What to do

• Don’t start Codex, Claude Code or any other agent in ~/Downloads. Start it in the folder of the project it should work on.
• Read any AGENTS.md or CLAUDE.md you didn’t write before an agent sees it, including in repos you just cloned.
• Check ~/.codex/config.toml for [mcp_servers.*] blocks you didn’t add, and a project’s .claude/settings.json for an ANTHROPIC_BASE_URL or other endpoint you didn’t set.
• Keep approval prompts and sandboxes on, and distrust any instruction that asks the agent to bypass them.
• Found one? Assume your token leaked and rotate it. If function-color shows up in your installs, treat that machine as compromised.