OpenAI Codex follows a planted AGENTS.md in a user's Downloads folder and tries to install a malicious npm package

What happened

Forever Security, which monitors how companies' AI agents behave, reported on October 22, 2026 that its software had stopped a coding agent on a customer's machine from installing `function-color`, an npm package from a malware campaign that Checkmarx documented as "malfex." The cause was an AGENTS.md file in the customer's `~/Downloads` folder, which was also the folder the agent was working in. AGENTS.md is a file Codex reads and follows as project instructions.

The planted file was about 13 KB and written to look like ordinary engineering guidelines. Forever says the length and routine tone helped: a short file that simply asked for the install was refused. One section told Codex to add a "project-tools" server to its machine-wide settings file (`~/.codex/config.toml`) with a startup command that installed the package, then start a second Codex session with approvals and sandboxing turned off, then carry on with the user's actual task. Once that settings change is written, every later Codex session on the computer loads the attacker's server, in any project.

Forever could not establish how the file got into Downloads. It showed separately that a web page can save a file named AGENTS.md there through normal browser download behavior, with no click needed, and that about a quarter of agent sessions it sees open a real browser.

In Forever's own tests, rebuilt with a harmless stand-in that opened a calculator, "Codex ran the malware in more than 90% of attempts." The real package was run once, in an isolated virtual machine. The researchers also tried a similar planted CLAUDE.md against Anthropic's Claude Code. It was harder to fool and needed a different attack: a settings change, presented as a company gateway, that sent Claude's API traffic to a server the researchers controlled. Claude followed through about 50% of the time, which exposed the user's login token, and in about a fifth of attempts the researchers got code running in the session. That part was a researcher test, not an attack seen on a real machine.

Impact

On the customer's computer the install was blocked, by Forever's software rather than by Codex. The sources do not say whether the settings change had already been written before the block, or when the file was planted or found. No data loss is reported. Forever says about half of its customers run a coding agent inside their Downloads folder, so the exposure is wide.

Vendor response

None published. Neither OpenAI nor Anthropic has commented in the coverage, and the report does not mention disclosure to either. The researchers argue there is nothing to patch: "An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do." Both vendors already advise running agents from the specific project folder, not the home directory or a broad parent folder.

Takeaway

An instruction file in the working folder is trusted input, and the Downloads folder is a place websites can write to. Don't start a coding agent in Downloads. Read any AGENTS.md or CLAUDE.md you didn't write, check agent settings files for servers or addresses you don't recognize, keep approvals and sandboxing on, and treat any instruction to turn them off as an attack. If `function-color` was ever installed on a machine, treat that machine as compromised.