On October 22, 2026, Forever Security, which sells monitoring for AI agents, published "Markdown Is the New Executable" by Gal Weizman and Omer Samet. BleepingComputer reported on it on October 25. The report starts with an incident: Forever stopped a customer's coding agent mid-session as it tried to install function-color, a known malicious npm package. The instruction came from an AGENTS.md file in the customer's ~/Downloads folder, which was also the agent's working directory. Nobody knew how the file got there.
Why the Downloads folder matters
Forever's argument rests on two ordinary behaviours. Coding agents read and follow instruction files in the folder they are started in. And "~/Downloads is special. It is the one folder the web can write to on its own." A web page can therefore deliver a file named AGENTS.md that never executes, so the guardrails built for executables never apply. BleepingComputer adds a qualification: Chrome, Edge and Firefox save downloads without asking by default but do show a download notification, while Brave prompted for approval in its tests. Forever's claim that the drop is "silent" should be read with that in mind.
How the Codex chain worked
The researchers ran the real file from the customer's machine against Codex inside an isolated VM. It is a long "Engineering Work Guidelines" document, which Forever puts at 13 KB, with the attack disguised as routine environment setup near the end. Forever says a short, obvious instruction was refused and the mundane framing got through. The file tells Codex to add a tools-server entry to ~/.codex/config.toml. That is Codex's machine-wide configuration, so the entry loads in every later session in any folder. The file then has Codex start a child session with approvals and the sandbox disabled, a flag Forever says the model wrote itself because the file presented it as necessary. Codex only follows AGENTS.md in a trusted project, and a folder the user has worked in before qualifies. Forever says Codex ran the payload in more than 90% of attempts.
Claude Code needed a different attack. A crafted CLAUDE.md got the agent to send its API traffic to a server the researchers controlled. That exposed the agent's OAuth token and let the server answer as if it were the model, returning tool calls that Claude Code ran. Forever says this worked "about 50% of the time". In BleepingComputer's words, the test redirected Claude Code's traffic "to a server they controlled".
Forever's position is that "There is nothing here for OpenAI or Anthropic to patch". Both vendors recommend starting an agent in the root of the project it should work on. Forever also says that in its telemetry "about half" of customers run a coding agent inside Downloads, and its researcher told BleepingComputer that Claude Code alone had launched more than 1,300 sessions from that location.
What remains uncertain. All the figures come from one vendor's customers and tests, and the delivery path for the real file is unknown. The 90% and 50% rates depend on prompts the researchers tuned.
Analysis: The detail to act on is persistence, not the injection itself. An instruction file is untrusted input, but an agent that can write its own configuration turns one bad session into all future sessions. Treat agent config directories such as ~/.codex and ~/.claude as protected paths that the agent cannot write without a human approval. Deny any agent-initiated command that disables approvals or the sandbox, however it is justified. Pin trusted instruction files by content hash, not only by folder. And keep Downloads, the home directory and any other folder the web or a mail client can write to out of the trusted-project list. These controls hold however persuasive the prose is.
Sources and evidence
Forever Security's October 22 report (BleepingComputer, October 25) traced a coding agent's attempt to install the malicious npm package function-color to an AGENTS.md in a customer's ~/Downloads folder; in the vendor's tests the file got Codex to edit its machine-wide config and launch a sandbox-bypassing child session in over 90% of attempts, and a CLAUDE.md variant leaked Claude Code's OAuth token about half the time. Protect agent config paths and keep web-writable folders out of trusted projects.