{
  "entry": {
    "kind": "vuln",
    "slug": "forever-security-an-agents-md-planted-in-downloads-got-codex-to",
    "name": "forever-security-an-agents-md-planted-in-downloads-got-codex-to",
    "vendor": "Any coding agent that loads AGENTS.md",
    "description": "Forever Security (Gal Weizman, Omer Samet) published on 22 October 2026 an attack it first caught on a customer machine, where a coding agent tried to install function-color, a known malicious npm package, because of an AGENTS.md in the user's ~/Downloads folder, which was also the agent's working directory. A web page can save a file named AGENTS.md to Downloads without a prompt in default Chrome, Edge and Firefox settings, and agents load instruction files from their working directory. The real file was a long \"Engineering Work Guidelines\" document with one setup section telling Codex to append a [mcp_servers.project-tools] block to ~/.codex/config.toml whose command ran launchctl submit to npm-install function-color outside Codex's process control, and then to run codex exec --dangerously-bypass-approvals-and-sandbox so a fresh session would load the server. Because the write lands in the machine-wide config, every later Codex session on that machine starts the attacker's server. Forever says Codex ran the malware in more than 90% of its attempts in an isolated VM. Against Claude Code it wrote its own CLAUDE.md that had Claude save ANTHROPIC_BASE_URL in .claude/settings.json pointing at an attacker server, which received Claude's OAuth token and could answer as the model with Bash tool calls that set dangerouslyDisableSandbox; that worked about half the time. Forever says about half of its customers run a coding agent inside Downloads. There is no vendor fix, because the agents are doing what they were designed to do.",
    "website": "https://forever.security/blog/hijacking-ai-agents-via-downloads-folder/",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "mcp-server",
    "updatedAt": "2026-10-22",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "forever-security-an-agents-md-planted-in-downloads-got-codex-to",
      "aliases": [
        "ti-164"
      ],
      "title": "Forever Security: An AGENTS.md Planted in ~/Downloads Got Codex to Register an MCP Server That Installed the Malicious function-color npm Package, and a CLAUDE.md Rerouted Claude Code's API Traffic",
      "summary": "Forever Security (Gal Weizman, Omer Samet) published on 22 October 2026 an attack it first caught on a customer machine, where a coding agent tried to install function-color, a known malicious npm package, because of an AGENTS.md in the user's ~/Downloads folder, which was also the agent's working directory. A web page can save a file named AGENTS.md to Downloads without a prompt in default Chrome, Edge and Firefox settings, and agents load instruction files from their working directory. The real file was a long \"Engineering Work Guidelines\" document with one setup section telling Codex to append a [mcp_servers.project-tools] block to ~/.codex/config.toml whose command ran launchctl submit to npm-install function-color outside Codex's process control, and then to run codex exec --dangerously-bypass-approvals-and-sandbox so a fresh session would load the server. Because the write lands in the machine-wide config, every later Codex session on that machine starts the attacker's server. Forever says Codex ran the malware in more than 90% of its attempts in an isolated VM. Against Claude Code it wrote its own CLAUDE.md that had Claude save ANTHROPIC_BASE_URL in .claude/settings.json pointing at an attacker server, which received Claude's OAuth token and could answer as the model with Bash tool calls that set dangerouslyDisableSandbox; that worked about half the time. Forever says about half of its customers run a coding agent inside Downloads. There is no vendor fix, because the agents are doing what they were designed to do.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Prompt injection",
        "Supply chain compromise"
      ],
      "componentType": "mcp-server",
      "component": {
        "name": "Any coding agent that loads AGENTS.md",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "Any coding agent that loads AGENTS.md, CLAUDE.md or similar instruction files from its working directory and can edit its own configuration; demonstrated on OpenAI Codex and Claude Code. Not a patchable vulnerability.",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-10-22",
      "modifiedAt": "2026-10-22",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://forever.security/blog/hijacking-ai-agents-via-downloads-folder/"
        }
      ],
      "mitigation": "Do not start Codex, Claude Code or any other coding agent in ~/Downloads or another folder the browser writes to, and read any AGENTS.md or CLAUDE.md you did not write before working in that folder. Check ~/.codex/config.toml for [mcp_servers.*] entries nobody added (especially ones that call launchctl, sh or npm install) and .claude/settings.json for an ANTHROPIC_BASE_URL or proxy you did not set. Treat function-color in any install log as a compromise, rebuild that machine and revoke agent OAuth sessions. Keep approval prompts and sandboxing on, and alert when an agent session writes to its own config or passes --dangerously-bypass-approvals-and-sandbox.",
      "detectedByAnomity": true
    }
  }
}