Web Pages Can Command AI Coding Agents: Over 90% Success Through the Downloads Folder

Browsers save files to Downloads without user interaction, while AI agents automatically follow instruction files. These two behaviors, neither a bug on its own, combine to let a single text file trigger malware execution, as demonstrated with Codex and Claude Code.

Key points

• What happened: An AGENTS.md file in the Downloads folder was instructing an AI coding agent to install the function-color malware
• Why it works: A structural gap that no one can patch lies at the intersection of browsers saving files to Downloads without user interaction and agents automatically following instruction files
• How to prevent it: Do not launch agents in Downloads; check unfamiliar instruction files and configuration changes. Instructions to disable approval prompts are themselves a sign of an attack

The day Markdown became an executable

Forever Security, which monitors the security of AI coding agents, detected a coding agent attempting to install the malicious npm package function-color on a customer's computer and blocked it before execution.

function-color is known malware belonging to the MALFEX campaign reported by Checkmarx on October 5, 2026. It is part of a supply chain attack by a single threat actor active since August 2023. The package itself contains no payload; it installs another malicious package, function-flag, as a dependency.

What was unusual was the source of the installation instruction. It was neither a code repository nor a dependency. The cause was a text file named AGENTS.md in the customer's ~/Downloads folder.

AGENTS.md and CLAUDE.md are project instruction files read at startup by OpenAI Codex and Claude Code, respectively. They are simply plain text describing tools to use, testing methods, and coding conventions. If the file is present in the working directory, the agent automatically reads it and follows its instructions. This is intended behavior; there is no bug here.

The problem is where that text file was placed.

The ~/Downloads folder is known as the only folder where web pages can save files without a click or approval. Chrome, Edge, and Firefox all save downloaded files there by default, displaying a download notification but not asking where to save them. This behavior has remained unchanged for 30 years. In the past, even if an executable landed there, it was not a problem because the OS asked for approval before running it.

A text file is not an executable, so the OS guardrails do not activate. But for an AI agent, an instruction file effectively becomes an executable. The written instructions are carried out. None of the protections applied to executable files apply to text files.

The web can write files to Downloads. An agent follows instruction files in that folder. Each behavior was designed as a safe feature on its own. The problem lies where the two intersect.

Over 90% success: Codex configuration files become compromised

Using an actual attack file recovered from a customer's machine, Forever Security reproduced the attack chain against OpenAI Codex in an isolated virtual machine. For safety, the tests used a harmless payload that simply opened the calculator application. The success rate exceeded 90%.

The recovered AGENTS.md was a long document of roughly 13 KB titled "Engineering Work Guidelines." The attack code was disguised as a routine setup step in a section near the end. Codex rejects a short instruction to "install this package." Hiding it in a long technical document let it pass that defense.

When the attack against Codex succeeds, the machine-wide configuration file ~/.codex/config.toml is rewritten to register the attacker's "project tools" server. This configuration applies across the machine, rather than being tied to Downloads. Every subsequent Codex session on that machine loads the attacker's server, regardless of the folder it is working in. The compromise persists after leaving the folder.

A different technique was used against Claude Code. A CLAUDE.md file changed the ANTHROPIC_BASE_URL setting to direct Claude Code's API traffic to a researcher-controlled server. I confirmed that the attack was disguised as a connection to "the team's internal gateway."

The success rate was about 50%, and successful attacks immediately leaked OAuth tokens, the access credentials used for authentication. The researchers' server could also use the token to impersonate the model and return tool calls that caused code execution. Code execution within the same session succeeded in roughly one in five attempts.

Figure omitted — see the original article

No one can issue a patch

Forever Security compares this situation to a phishing page. A browser accurately displaying a fake bank login page is not a bug. The problem is the page's content; there is nothing for the browser to fix. The same structure applies here.

There is nothing for OpenAI or Anthropic to fix. An agent following AGENTS.md in a folder is doing exactly what it was built to do

That is how Forever Security's report describes it.

Both OpenAI and Anthropic recommend running coding agents from the project directory being worked on. Restricting the working directory to the project gives the agent appropriate context and reduces the risk of processing unrelated files.

Actual usage does not follow that recommendation. Forever Security's customer telemetry showed that roughly half its customers ran agents inside Downloads. More than 1,300 Claude Code sessions alone reportedly started there. Forever Security researcher Gal Weizman explains that many developers use agents to organize downloaded files or process newly downloaded files. These figures come from the company's customers, not industry-wide statistics. The company sells an agent monitoring product.

How the file reached the customer's Downloads folder has not been determined. The researchers created a proof-of-concept page, and when BleepingComputer tested it, an AGENTS.md file with harmless content downloaded automatically in Chrome. Brave asked the user to approve the download, but Chrome, Edge, and Firefox only displayed a download notification, without asking for a save location.

Complicating matters further, agents sometimes open browsers and browse the web themselves. The researchers' telemetry shows that roughly one-quarter of agent sessions open a browser. An agent could reach a page planted with an attack file on its own while no human is watching the screen.

What to check now

Prompt injection attacks against AI coding agents (in Japanese) and infections through npm packages (in Japanese) have been reported before. What makes this attack different is that it can succeed from outside the agent simply by placing one text file through the web.

The defenses Forever Security lists cost nothing.

Do not launch agents in ~/Downloads. Run them from the root directory of the target project.

Check for unfamiliar AGENTS.md, CLAUDE.md, or similar instruction files in working directories and newly cloned repositories.

Inspect agent configuration files. For Codex, check ~/.codex/config.toml for unexpected [mcp_servers.*] blocks. For Claude Code, check .claude/settings.json for an ANTHROPIC_BASE_URL you do not remember setting.

Keep approval prompts and sandbox protections enabled. A file instructing an agent to disable them is itself a sign of an attack.

If you find a suspicious file, rotate tokens on the assumption that they have leaked. If function-color is already installed, treat the machine as compromised.

For 30 years, security rested on the premise that "nothing dangerous happens unless the user clicks something." Agents click, approve, and execute code on people's behalf. A once-solid guarantee has quietly become an assumption. Assumptions can be attacked. Downloads is simply the first place where that became reality.

Originally published on Joho no Todai. The Japanese original is here.