Who left this note for your AI agent? (A 2-minute check for Codex and Claude Code users)

A web page can save an AGENTS.md into your Downloads folder without a single click. Your coding agent reads it as project rules. Here's what happened, what we saw in our own test, and the 2-minute check.

Your Downloads folder is the only folder on your computer that strangers can write to.

That's been true for 20 years, and it never mattered much. A downloaded.exe won't run until you say yes, so a random file sitting in Downloads was just clutter.

But a file named AGENTS.md or CLAUDE.md isn't clutter anymore. To an AI coding agent, it's an order.

On 22 October, the security firm Forever Security described something they caught on a real customer's laptop. A coding agent was in the middle of installing function-color, a known malicious npm package.

The order didn't come from a dependency or a repo. It came from an AGENTS.md in the customer's ~/Downloads folder. Nobody remembered putting it there.

Codex: it added an MCP server (a plug-in tool server the agent starts on launch) to ~/.codex/config.toml. That server ran npm install function-color. Forever says this worked in more than 90% of their tries, using the attacker's real file inside an isolated VM.

The nasty part: that config is machine-wide. Every later Codex session, in any folder, starts the attacker's server. One catch for the attacker: Codex only follows AGENTS.md in a folder you've marked as trusted. If you've ever worked in Downloads before, it counts.

Claude Code: Forever wrote their own CLAUDE.md for this one. It asks Claude to save ANTHROPIC_BASE_URL into.claude/settings.json, which sends Claude's API traffic, login token included, to the attacker's server. That server can then answer as if it were the model and order Bash commands. Approval prompts often caught it, but it still worked about 50% of the time.

And this isn't a bug, so there's no patch coming. Both agents are doing exactly what they were built to do: follow the rules file in the folder you opened. Forever says about half of their customers had run an agent inside Downloads at some point.

We wanted to see this with our own eyes, without touching anything dangerous. On Claude Code 2.1.278 (Sonnet 5), we made a scratch folder with two fake rules files:

Then we asked the same innocent question nine times: "What files are in this folder?"

Claude obeyed 0 of 9 times. It never wrote canary.txt, not even with file edits auto-approved. In every file B run, it pointed out the planted instruction and refused it.

That's good news, but don't read it as "safe". Our file was a short, clumsy note. The real one is a 13 KB document tuned to look normal, and Forever found that the same payload failed in a folder full of security notes but worked in a plain one. A clumsy note getting caught tells you very little about a careful one.

Run these three checks. Each one only reads files and changes nothing.

1. Any rules files sitting in Downloads?

# macOS / Linux ls ~/Downloads | grep -iE '^(AGENTS|CLAUDE|GEMINI)\.md$' Enter fullscreen mode Exit fullscreen mode # Windows PowerShell Get-ChildItem " $HOME \Downloads\*" -Include AGENTS.md, CLAUDE.md, GEMINI.md Enter fullscreen mode Exit fullscreen mode 2. Any MCP servers or base URLs in Codex's config you didn't add?

grep -nE '^\[mcp_servers|base_url' ~/.codex/config.toml Enter fullscreen mode Exit fullscreen mode Select-String -Path " $HOME \.codex\config.toml" -Pattern '^\[mcp_servers|base_url' Enter fullscreen mode Exit fullscreen mode 3. Has anything rerouted Claude Code's API traffic? Run this in your home folder and in each project you use Claude in.

grep -n -E 'BASE_URL|proxy' ~/.claude/settings *.json.claude/settings *.json 2>/dev/null Enter fullscreen mode Exit fullscreen mode Get-ChildItem " $HOME \.claude", ".\.claude" -Filter 'settings*.json' -ErrorAction SilentlyContinue | Select-String 'BASE_URL|proxy' Enter fullscreen mode Exit fullscreen mode How to read what you find:

An entry isn't automatically bad. An entry you can't explain is.

Markdown used to be the safest file type on your computer. Now it's the one your agent obeys.

Sources: Forever Security, "Markdown Is the New Executable" (22 Oct 2026). The success rates above are Forever's numbers. They sell agent monitoring, so read them as one firm's tests, not an industry measurement.