Text file in Downloads can hijack Codex and Claude Code, Forever says

A plain text file sitting in a Downloads folder can take control of an AI coding agent, according to security firm Forever. Forever says it halted a coding agent on a customer's computer in the middle of a session as it tried to install function-color, a known malicious npm package.

The source of the order was a file the agent trusted. Forever says it tracked the install command to an AGENTS.md instructions file sitting in the customer's Downloads folder, a type of file Codex loads when it starts.

Key facts

• Forever says Codex installed the malware in more than 90% of tries when the researchers ran the attacker's real file in an isolated VM.
• Forever says Claude Code carried out its own crafted attack about half the time.
• Forever says about half of its customers run a coding agent inside their Downloads folder.
• Forever says neither OpenAI nor Anthropic has anything to patch, since the agents obey instructions files by design.
• Forever notes that npm has since taken down the function-color package.

How the attack works

The trick relies on a folder that websites can write to. Forever argues that Downloads is the only folder where a website can place a file with no click and no permission prompt.

The planted file did not look like an attack. Forever says the real file was a 13 KB engineering-guidelines document, because a brief, obvious request to install software was refused.

The damage did not stay in one folder. Forever says Codex wrote the attacker's server into its global settings file, so every later Codex session on that machine loads it, wherever it runs. The researchers summed it up this way: "You can leave the folder. The poison stays."

Forever also tested Claude Code. The firm says it wrote its own CLAUDE.md file that sent Claude's API traffic to a server the researchers controlled. Forever says that Claude Code followed that file about 50% of the time, revealing an OAuth token the team was able to reuse.

The malware itself had a long run. Forever says the function-color campaign went unnoticed for about two years before it was publicly documented.

Background

This kind of attack is known as prompt injection. Anthropic describes prompt injection as hostile instructions hidden in content that an AI model reads, and says the problem is far from solved.

Anthropic has built limits into Claude Code. The company says Claude Code starts in read-only mode and asks before it changes files or runs most commands. Anthropic also says sandboxing cut permission prompts by 84% in its own use while restricting which folders and servers Claude can reach.

There are important limits to what is known. Forever's figures come from the vendor itself and have not been checked by anyone else. The Claude Code test used a file Forever made, not one found in the wild. Forever has also not shown how the planted file reached the customer's computer, and its web-download route is a demonstration, not a confirmed path.

What it means for you

The exposed group is specific. Forever says developers who start Codex, Claude Code or similar agents inside Downloads, or who let agents browse the web on their own, are the ones at risk.

The risk comes from normal behavior, not a broken feature. Forever says the agents act on the instructions file in their folder exactly as they were built to. That means the fix depends on how people set up and run their agents.

Practical steps

• Pick a different folder. Forever advises users not to launch Codex, Claude Code or any agent in Downloads, and to read any unfamiliar AGENTS.md or CLAUDE.md first.
• Keep safety features on. Forever recommends leaving approval gates and sandboxes switched on and treating any instruction to skip them as a warning sign.
• Rotate tokens if in doubt. Forever says a token used by an agent that followed a planted file should be revoked and swapped for a new one.
• Check installs. Forever says a machine with function-color in its installs should be treated as compromised.

What happens next

Agent makers have tools that narrow the damage. Anthropic says its sandbox runtime can limit which folders and network hosts an agent reaches, which caps what a hijacked agent can do.

It is not known whether OpenAI or Anthropic will change how their agents behave in response. Neither company had commented in the sources reviewed.

FAQ

Is this a bug OpenAI or Anthropic can patch? Forever says no, because the agents follow the instructions file in their folder as designed.

How often did the attacks work? Forever says Codex ran the malware in more than 90% of attempts and Claude Code followed the crafted file about half the time.

What should I check first? Forever suggests looking for unfamiliar AGENTS.md or CLAUDE.md files and for function-color among installed packages.

Does Claude Code have any built-in protection? Anthropic says Claude Code is read-only by default and asks permission before most changes or commands.

Is function-color still on npm? No. Forever says npm has removed the package.

Why the Downloads folder? Forever says it is the one folder a website can drop a file into without a click or a permission prompt.

What did the Claude Code test expose? Forever says its crafted CLAUDE.md rerouted Claude's API traffic and exposed an OAuth token the researchers could replay.

Does leaving the folder end the attack? Not for Codex. Forever says the attacker's server was written into Codex's global config, so later sessions load it in any folder.

How common is running agents in Downloads? Forever says about half of its customers do it, based on its telemetry.