Forever Security found a malicious AGENTS.md file in a customer's Downloads folder that tried to hijack an AI agent
Security firm Forever Security said it caught live malware on a real customer's machine: an AGENTS.md file in the ~/Downloads folder. Disguised as engineering notes, it ordered the AI agent to deploy malware and exfiltrate session tokens. The attackers tried to get the agent to install a malicious npm package called 'function-color'. The researchers said they stopped the attack before it did meaningful damage, and that they reproduced it on both OpenAI Codex and Claude Code, calling it a design issue rather than a patchable bug.
What the AI did
Attackers reportedly planted a file called AGENTS.md, disguised as engineering notes, in a customer's Downloads folder, aiming to get an AI coding agent to install a malicious software package called 'function-color' and steal session tokens (the digital keys that keep someone logged in). The attack was stopped before meaningful damage, but the researchers said that when they recreated it, it succeeded on both OpenAI Codex and Claude Code.
First reported October 26, 2026 · Added to the register November 4, 2026 · 1 source
- Model
- OpenAI Codex, Claude Code
- Affected
- A Forever Security customer
- When it happened
- Not stated in the sources
- First reported
- October 26, 2026
What this means for you
Could this affect you?
If your developers use AI coding agents such as OpenAI Codex or Claude Code. Developers and organisations running coding agents on machines where web browsers can silently save files to the Downloads folder could have their session tokens and computers put at risk if the agent follows planted instructions.
What to check
- Do not start coding agents in the Downloads folder.
- Read any instruction files you did not write before letting an agent use them.
- Keep approval steps and sandboxes (isolated environments) switched on, and check agent settings for unexpected web addresses or proxies.
- Change your tokens if a malicious instruction file is found.
Areas of your AI programme this touches
Every fact and its source (6)
- Malware payloadMalicious npm package 'function-color'“the attackers tried to get the AI agent to install a malicious npm package called”[1]
- OutcomeStopped before meaningful damage“stopped it before it was able to do any meaningful damage”[1]
- Researcher reporting the attackForever Security“Researchers Forever Security claim to have seen the attack play out in the wild”[1]
- Vendor fix statusNot a bug; nothing to patch“The bad news is that this is not a bug”[1]
- Malicious file locationAGENTS.md in ~/Downloads“an AGENTS.md file in the ~/Downloads folder”[1]
- Instructions in the fileDeploy malware and exfiltrate session tokens“it turned the AI agent rogue, ordering it to deploy malware and exfiltrate session tokens”[1]
Sources
- AI agents tricked by a rogue downloads file into running dangerous malwaretechradar.com · October 26, 2026
How this record is classified. Severity M (2/5): harm to individuals, or a policy breach with limited reach. OECD level: hazard, an event that could plausibly have led to harm. Evidence: Alleged, meaning one party's claim.
The facts in At a glance and in Every fact and its source are quoted from the sources listed. The summary, What the AI did and What this means for you are written from those sources and checked against them automatically before publication. Records reflect what has been disclosed, not everything that has happened. Incidents are found through news feeds and the GDELT Project.
