A text file in Downloads made Codex install malware — 9 times in 10

Security firm Forever says it caught a real attack in the wild: a plain-text AGENTS.md file sitting in a customer's Downloads folder ordered an AI coding agent to install function-color, a known malicious npm package. In Forever's tests, the planted file got OpenAI's Codex to run the malware in more than 90 percent of attempts.

The trick works because coding agents read instruction files from whatever folder they are started in — and a website can save a file to Downloads without asking, depending on browser settings. A Claude Code variant worked about half the time and leaked the tool's login token. Forever says neither tool has a bug to patch: the agents did what they were built to do. The fix is on the user: never start an agent in Downloads, and read instruction files you did not write.