A web page can plant a file your coding agent treats as orders, and Codex carried them out more than nine times in ten

On a customer's laptop, an AI coding agent began installing a package called function-color from npm. The package belonged to a malware campaign that had been sitting in the registry for roughly two years before researchers documented it. 1 Forever Security, which sells monitoring for what agents do on a machine, caught the install and stopped it before any code ran.

The order came from a file in the customer's ~/Downloads folder: an AGENTS.md, plain text, dressed up as ordinary engineering notes. Nobody at the company had written it. Nobody could say how it got there. 2

Nothing in that file was code. The agent followed it because reading the instructions file in its working folder is what these agents are built to do.

That is the shape of a supply chain problem PMs now own: the thing being distributed is a paragraph.

Codex, Claude Code, Gemini CLI and Cursor all read a Markdown file at startup if it sits in the folder they were opened in — AGENTS.md, CLAUDE.md, GEMINI.md. The file carries the project's conventions, the commands that run the tests, the house style. Each agent also loads configuration from the same folder: which external tool servers to launch at startup (MCP, a standard way for an agent to start and talk to tool processes), which hook scripts to run at particular moments, which pre-approved commands skip the prompt, and which API endpoint to talk to.

That machinery earns its place. A team that writes its conventions into AGENTS.md stops re-explaining them in every prompt, and a team that declares its tool servers in .mcp.json gets them loaded without setup.

The trust is deliberate too. The file sits in a folder you control; the first time you work in that folder, you read it and accept it. Forever's summary of what happens next: an agent that follows the AGENTS.md in its folder is doing exactly what it was built to do, the same way a browser that renders a phishing page is working as designed. 2

Operating systems closed this door once already. A program downloaded from the internet will not run until you approve it. A Markdown file is not a program, so none of those guardrails apply to it — until an agent reads it, at which point its sentences start doing the work that code would have done.

Downloads is the one folder the web can write to. Chrome, Edge and Firefox save a download there without asking where, and tell you afterwards with a notification. Brave asks for approval first. BleepingComputer visited Forever's proof-of-concept page and watched it drop an AGENTS.md with no click and no prompt. 3

Then a person starts an agent in that folder. This is more common than it sounds. People open a coding agent in Downloads to tidy the folder, or to act on a file they just downloaded. Forever's telemetry puts about half of its customers in that habit. Roughly a quarter of agent sessions open a real browser, so nobody is at the screen when a file lands. Gal Weizman, one of the researchers, told BleepingComputer that Claude Code alone had opened more than 1,300 sessions from that folder. 3

The agent obeys the file. Forever did not build its own version of the attack. It took the attacker's 13-kilobyte file off the customer's machine and ran it inside an isolated virtual machine against Codex. In the company's testing, Codex executed the payload in more than 90% of attempts. Most runs used a harmless stand-in that opens a calculator; one run used the real malicious package. 2

The damage leaves the folder. The payload rewrote ~/.codex/config.toml, which is Codex's config for the whole machine, and registered a tool server whose startup command installs the package. From then on every Codex session in any project launches the attacker's server. Leaving Downloads does not undo it. 4

Claude Code held out longer, and the attack that worked looks nothing like the Codex one. A planted CLAUDE.md asked Claude to save a .claude/settings.json that points its API traffic at a server on a domain the researchers own, dressed up as the team's internal gateway.

Claude requires a human to approve a write like that and often refuses ones that look wrong. The long, bland engineering-document framing got the write approved about half the time. Once written, every request carries Claude Code's OAuth login token to that server, which is account takeover on its own; the researchers replayed a captured token against the real API and were served as the victim. On the next launch in that folder, their server answered as the model and returned a shell command with the sandbox switched off. About one time in five, the running session spawned a subagent quickly enough to get code execution inside the same session.

How the file reached that particular machine is unknown. The download route was demonstrated on a purpose-built page; whether a real attacker used it against this customer, nobody established.

Downloads is the route that made the news. A compromised dependency is the route that will show up in more companies.

NVIDIA's AI red team built a Go library that checks whether it is running inside Codex, and only then writes an AGENTS.md into the project root. The file orders the agent to insert a five-minute sleep into every Go main function, to leave that change out of the pull request title and summary, and to ignore whatever the developer actually asked for. It also plants a code comment instructing any AI summariser to omit the sleep. 5

Codex did it, and the pull request read as an ordinary greeting change. NVIDIA reported the chain to OpenAI on 1 July 2025. OpenAI concluded on 19 August that the attack did not significantly raise risk beyond a compromised dependency, which is a defensible reading of the prerequisite. The point for a product team is narrower and still sharp: the instruction file is a surface that ordinary build-time code can reach.

Forever's own conclusion is that there is nothing here for OpenAI or Anthropic to patch, because nothing in either product is broken. The company compares the situation to phishing: the browser rendered the page it was given, and the attack lives in the page.

Mindgard reached the same wall earlier and from a different angle. In February 2026 it reported that trust attaches to the folder path rather than to the content that earned the trust. Approve a repository once, and a later commit that changes the auto-executed config inside it will load without a new approval. 6

All three vendors closed it. Anthropic closed the Claude Code report as Informative. OpenAI closed the Codex report as Informational, at its lowest severity tier, and raised approval fatigue as the concern. Google closed the Gemini CLI report as Won't Fix, intended behaviour.

The surrounding toolchain already treats this as a bug class. Check Point reported the same pattern against Cursor in August 2025, CVE-2025-54136, where approval was bound to a tool server's name and not to its command; Cursor shipped a fix thirteen days later, rated 7.2 out of 10. 7 VS Code's documentation states that changing an MCP server's configuration requires re-confirming trust in that server. 8 GitHub requires a fresh approval for workflow-file changes arriving from a fork, because a workflow file is configuration that executes. 9

So the control is a known quantity, and it is short: hash the executable config files when the user approves a folder, store those hashes with the approval, re-hash at every session start, and require a fresh approval with a diff and the offending commit whenever anything changed. Mindgard notes that Codex already computes a config fingerprint internally; using it to invalidate stale trust is the missing step.

If a team is asked to carry that risk, the benefit should be measurable. The one controlled test of it found no gain.

A study published in July ablated the context-injection strategy across Claude Code and Codex: 17 real tasks in three repositories, 288 scored runs, gold tests. Correctness did not move on either agent, within a 10-to-15-point equivalence bound. The agents failed on implementation skill — feature design, choosing a pattern, wiring it up — rather than on missing repository knowledge that a context file could have supplied. A manipulation probe found the real AGENTS.md never turned a near-miss into a pass. 10

Two agents and 17 tasks is a small base, and the paper says so. What it establishes is that the instruction file's benefit is smaller and harder to demonstrate than its adoption suggests, while the tool-server and hook configuration is a different matter, since that half genuinely adds capability.

The part of the mechanism that carries the attack is the part with the thinnest evidence of benefit.

Five actions, cheapest first, and none of them waits on a vendor release.

Never start Codex, Claude Code, Cursor or any other agent in ~/Downloads, in your home directory, or in a parent folder of everything. OpenAI and Anthropic both recommend the root of the specific project, which bounds what the agent can read to files that belong to the work.

Read any instruction file you did not write, including in a repository you just cloned. A stray AGENTS.md or CLAUDE.md is the entire attack.

Check the two config files that decide what runs and where traffic goes. In ~/.codex/config.toml, look for an [mcp_servers.*] block you did not add or a base URL you did not set. In a project's .claude/settings.json, look for ANTHROPIC_BASE_URL, a proxy, or any endpoint that is not yours.

Keep the approval prompts and sandboxes on, and read any instruction that tells the agent to switch them off as hostile. The Codex payload wrote --dangerously-bypass-approvals-and-sandbox into its own command line; the Claude payload set dangerouslyDisableSandbox to true. 2

If you find a planted file, rotate the login token that agent was using. A stolen token is a live session, and deleting the file does not end it.

For the product side, two changes cost more and hold up better.

Treat instruction files and executable config as code. Give them code owners, and route any change to them through the same review a CI workflow change gets. In a forty-file pull request, nobody notices command: "npx" becoming command: "bash".

Test rule files for what they actually ask for. Aletheia, published in September, translates a rule file into a typed permission language, removes one permission at a time, and re-runs the unchanged task in a restricted sandbox to see whether the rule still works. Rules asking for permissions the task never needed are flagged. It caught all 314 attack rules in its benchmark set with three false positives across 85 benign rules, at 44 seconds and about 22 cents per rule. 11

That price turns "review every instruction file we accept" from a policy into a CI job.

If you ship an agent product, the same two controls belong in your own trust model, and the second one is a design change rather than a bug fix.

Most security controls in a developer tool assume a person at the keyboard: someone clicks, someone approves, someone runs the code. An agent removes the person and does the browsing itself, and the attacker needs nobody to notice the file arrive. Every guarantee that leaned on a human staying awake has to be rebuilt for a machine that was told to keep working.

What to watch is whether any of the three vendors binds trust to content instead of to a path. Cursor took thirteen days once the same pattern reached a product it had to defend. Claude Code, Codex and Gemini CLI have taken eight months and counting.