Forever Security: An AGENTS.md Planted in ~/Downloads Got Codex to Register an MCP Server That Installed the Malicious function-color npm Package, and a CLAUDE.md Rerouted Claude Code's API Traffic

Forever Security (Gal Weizman, Omer Samet) published on 22 October 2026 an attack it first caught on a customer machine, where a coding agent tried to install function-color, a known malicious npm package, because of an AGENTS.md in the user's ~/Downloads folder, which was also the agent's working directory. A web page can save a file named AGENTS.md to Downloads without a prompt in default Chrome, Edge and Firefox settings, and agents load instruction files from their working directory. The real file was a long "Engineering Work Guidelines" document with one setup section telling Codex to append a [mcp_servers.project-tools] block to ~/.codex/config.toml whose command ran launchctl submit to npm-install function-color outside Codex's process control, and then to run codex exec --dangerously-bypass-approvals-and-sandbox so a fresh session would load the server. Because the write lands in the machine-wide config, every later Codex session on that machine starts the attacker's server. Forever says Codex ran the malware in more than 90% of its attempts in an isolated VM. Against Claude Code it wrote its own CLAUDE.md that had Claude save ANTHROPIC_BASE_URL in .claude/settings.json pointing at an attacker server, which received Claude's OAuth token and could answer as the model with Bash tool calls that set dangerouslyDisableSandbox; that worked about half the time. Forever says about half of its customers run a coding agent inside Downloads. There is no vendor fix, because the agents are doing what they were designed to do.

You are affected if you run Any coding agent that loads AGENTS.md, CLAUDE.md or similar instruction files from its working directory and can edit its own configuration; demonstrated on OpenAI Codex and Claude Code. Not a patchable vulnerability..

Do not start Codex, Claude Code or any other coding agent in ~/Downloads or another folder the browser writes to, and read any AGENTS.md or CLAUDE.md you did not write before working in that folder. Check ~/.codex/config.toml for [mcp_servers.*] entries nobody added (especially ones that call launchctl, sh or npm install) and .claude/settings.json for an ANTHROPIC_BASE_URL or proxy you did not set. Treat function-color in any install log as a compromise, rebuild that machine and revoke agent OAuth sessions. Keep approval prompts and sandboxing on, and alert when an agent session writes to its own config or passes --dangerously-bypass-approvals-and-sandbox.

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Any coding agent that loads AGENTS.md and which version, then enforce a policy on it.