Problem Solutions
How a Poisoned AGENTS.md File Can Hijack Your Coding Agent — and How to Stop It
Your AI coding agent trusts AGENTS.md the way you trust a README. That trust is now an attack vector. Security researchers at Forever Security reported on October 22, 2026 that they caught a malicious AGENTS.md file in a customer's Downloads folder telling a coding agent to install malware — and their tests show the trick works most of the time. Coverage of the report followed on October 25.
What actually happened
Forever's product stopped a coding agent mid-session from installing a package called function-color, a known malicious npm package from a campaign that went unnoticed for roughly two years before it was documented publicly. The npm registry has since replaced it with a security holding version. The blocked install was routine; the source of the instruction was not. It came from an AGENTS.md file in the customer's Downloads folder — which was also the agent's working directory.
The file was a long document dressed up as engineering work guidelines. One section near the end, disguised as routine setup, told Codex to add a project-tools server to the machine-wide configuration file before starting the user's task. That server launches function-color through npx. Forever says it stopped the attack before any code ran, and that nobody knows how the original file reached the Downloads folder.
How the attack works
AGENTS.md and CLAUDE.md are plain-text instruction files that coding agents — Codex, Claude Code, Cursor and others — are built to read and follow from their working directory. They might say "use tabs, not spaces" or "the tests run with npm test." The agent treats everything in the file as a trusted instruction from you. It does not stop to ask whether the person who wrote the file had permission to tell it to install software.
That is indirect prompt injection: the attacker never types into your chat. They plant instructions in something the agent already trusts, and the agent picks them up on its own. And Downloads is, in Forever's words, the one folder the web can write to on its own — a webpage can trigger a download into it, and BleepingComputer verified such a download using harmless file contents.
The persistence is the nasty part. Because the planted instruction wrote to Codex's machine-wide configuration, every later Codex session on the machine would load the attacker's server at startup, in any folder. The compromise survives leaving the folder where it started.
Forever's tests show how reliable the trick is. Against OpenAI Codex, a harmless payload that opened the calculator app succeeded in about 90% of attempts. A separate demonstration against Claude Code used a malicious CLAUDE.md file to redirect the agent's API traffic to a researcher-controlled server, exposing an OAuth token that could be replayed against the legitimate API — succeeding in roughly half of tests.
How to stop it
Vendors view this as expected agent behaviour rather than a software bug, so no patch is coming to save you. The defence is operational, and it is five habits:
Never launch an agent from your Downloads folder. Use a narrow, project-specific directory as the working directory, so a stray file in Downloads is never in scope.
Review unknown instruction files before running an agent. If a project contains an AGENTS.md or CLAUDE.md you did not write, read it — especially any section that touches configuration, servers, install steps or credentials — before you start the agent there.
Keep approval prompts and sandboxes enabled. The attack needs the agent to run commands with its permissions. Approval prompts and sandbox restrictions are the layer that forces a human decision before an install or a config change happens.
Check your machine-wide agent configs. Look at files like the Codex configuration for entries you did not add, particularly servers or tools you do not recognise. A planted entry there affects every session, not just one project.
Test untrusted projects in isolation. Code from strangers, downloaded repos and demo projects belong in a container or a disposable environment first, not in the directory where your agent holds your real credentials.
The rule of thumb is simple: your agent will obey any instruction file in its working directory, so treat that directory — and every AGENTS.md in it — as carefully as you treat your own password.