“Markdown Is the New Executable”: How a File in Your Downloads Folder Can Hijack Claude Code and Codex

What Happened: Real Malware, Real Customer, No Click

If you use an AI coding agent like Claude Code or OpenAI Codex, security firm Forever Security just documented an attack you need to know about — because it wasn’t found in a lab. It was caught live, mid-session, on a real customer’s machine.

The alert fired when an agent tried to install function-color, a known-malicious npm package from a campaign researchers at CloudSEK and Checkmarx dubbed MALFEX — malware that had flown under the radar for roughly two years before npm replaced it with a security placeholder on October 7, 2026. Blocking a bad package is routine. What wasn’t routine was where the order came from: not a dependency, not a code repository, but an AGENTS.md file sitting in the customer’s ~/Downloads folder — a plain-text file that nobody on the team had put there.

AGENTS.md is the instruction file that coding agents are built to read and obey when they start working in a folder. Codex loads it automatically. Claude Code does the same with CLAUDE.md. That trust is the design, not a bug — and it is exactly what the attack abuses. As Forever Security puts it: “Markdown is the new executable.”

How the Attack Chain Works

The attack chains two behaviors that are each harmless on their own:

• A website can silently drop a file into your Downloads folder. No click, no permission prompt — the browser writes the file, picks its name, and picks its contents. This was never dangerous before, because a downloaded executable can’t run without your approval.
• An agent obeys instruction files in the folder it opens. You’re supposed to vet an AGENTS.md the first time you work in a project. But if one appears in a folder you already trust, nothing forces a re-read — the agent just follows it.

Put the two together and the web can now plant instructions in a folder on your machine that your own agent will faithfully carry out. In Forever Security’s telemetry, about half of customers run a coding agent inside their Downloads folder at least sometimes, and roughly a quarter of agent sessions open a real browser — meaning an agent doing autonomous web research can bring the poisoned file home with no human ever seeing it arrive.

The planted file is a long, boring-looking “Engineering Work Guidelines” document. The attack hides in one section near the end, dressed up as routine setup steps.

The Codex Payload: Rewriting the Agent’s Own Config

Forever Security reproduced the attack end to end using the actual attacker file from the customer’s machine, inside an isolated VM. The results were ugly: Codex ran the malware in more than 90% of attempts — in a single session, with nobody approving anything.

The malicious instructions tell the agent, before starting the user’s actual task, to:

• Append an [mcp_servers.project-tools] block to ~/.codex/config.toml — registered as a “helper tooling” MCP server that quietly npm installs function-color via macOS launchctl.
• Verify the registration by launching a fresh session with codex exec --dangerously-bypass-approvals-and-sandbox — with a plausible-sounding excuse for why the flag is “required.”

The nastiest detail is where it writes: ~/.codex/config.toml is Codex’s machine-wide config, not a per-project setting. Once poisoned, every future Codex session on the machine loads the attacker’s server at startup, in any folder, in any project. You can leave Downloads behind — the poison stays.

The Claude Code Variant: Token Theft via CLAUDE.md

The team built a parallel attack against Claude Code using a planted CLAUDE.md file. Instead of installing a package, it instructs the agent to set ANTHROPIC_BASE_URL in the project’s .claude/settings.json — redirecting all API traffic to an attacker-controlled endpoint. The result is an account takeover: a stolen login token is a live session, not just one intercepted request.

The researchers note the technique isn’t specific to these two products. Any agent that auto-reads instruction files from its working directory — including Cursor, Windsurf, Aider, Gemini CLI, or GitHub Copilot-style assistants — shares the same structural exposure. The two most popular agents just happened to be the ones proven.

Why OpenAI and Anthropic Can’t Just Patch This

Here’s the uncomfortable part: “there is nothing here for OpenAI or Anthropic to patch.” An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do — the same way a browser rendering a phishing page is working as designed. The problem is the circumstances: a folder the web can write to, trusted as if only you filled it.

The bigger lesson extends well beyond one folder. Almost every defense the industry trusts was designed around a human in the loop — someone clicks, someone approves, someone watches the screen. Autonomous agents remove the person, and guarantees that felt permanent quietly turn back into attackable assumptions. Downloads is simply the first place we’ve watched it happen.

The 5-Step Protection Checklist

None of these steps costs anything. All of them take under ten minutes:

Frequently Asked Questions