下载目录里一份恶意 AGENTS.md 让 Codex 去装恶意 npm 包：真实客户机上被监控拦下，复现中九成以上照做（Forever 自测）A malicious AGENTS.md in the Downloads folder told Codex to install a malicious npm package: blocked by monitoring on a real customer machine, and followed in over 90% of reproduction runs (Forever’s own tests)

Real incident (per Forever’s report): a customer’s Downloads folder held an AGENTS.md of about 13 KB, dressed up as a dull engineering guide with the attack buried in a late section; the same folder was Codex’s working directory. Following the file, Codex wrote a tool-server entry into its global config, ~/.codex/config.toml, which installs the npm package function-color at session start; that package pulls in the downloader function-flag as a dependency, which fetches the final payload, part of a supply-chain campaign researchers named MALFEX. Forever’s monitoring stopped the install before any code ran: an attempt, with no reported data loss. Forever could not tell how the file got into the folder; the date and the customer were not disclosed. Once the global config is written, every later Codex session on that machine loads the attacker’s server, in any folder.

Reproduction (Forever’s own tests; trial counts not disclosed): Codex reproduced the full chain in an isolated VM in over 90% of attempts; BleepingComputer describes a reconstructed chain with a harmless payload that only opened the calculator, recording 90%, which does not match the blog’s wording that Codex ran the malware, so read the figure conservatively. A researcher-built CLAUDE.md variant (not a sample from the wild) got Claude Code to write a new API address into project settings, leaking the session token, which the researchers used to take over the account; Claude needs a human to approve that write, and the long engineering-document framing got it approved about half the time (BleepingComputer ties the half to the full chain). Code execution in the same session via a sub-agent came in about a fifth of tests (per Help Net Security). Delivery: Forever’s proof-of-concept page can save an AGENTS.md into Downloads as a visitor leaves; in BleepingComputer’s own test Chrome, Edge and Firefox only showed a download notice, while Brave asked first. This shows delivery is possible; it is not the route in this case.

Exposure (Forever customer telemetry, not independently verifiable): about half of customers run a coding agent inside Downloads, and about a quarter of agent sessions open a browser; Claude Code alone launched more than 1,300 sessions from that folder.

Party response: as of 2026-10-29, no public response from OpenAI or Anthropic. The discoverer’s position: “There is nothing here for OpenAI or Anthropic to patch”; an agent that follows its folder’s AGENTS.md is doing what it was built to do. The advice reported elsewhere to launch agents from the project directory is the vendors’ standing guidance, not a response to this case.

Evidence note: graded primary-source verified, but the primary source is the discoverer’s own account: the real customer incident rests on Forever alone, with an anonymous customer and no second-party confirmation, and all success rates and telemetry are Forever’s tests or data. Forever sells agent monitoring, and the report doubles as its product story. Three details (the 13 KB size, how long MALFEX has run, and the npm takedown) could not each be confirmed in the coverage; they are left out or attributed to Forever.

The first defence to fail was admission into context: a file of unknown origin was read in as trusted instructions simply because it sat in the agent’s working directory, with no check on where it came from. It is the same class of problem as INC-014 (a forged error event taken by a coding agent as a fix instruction): outside text entered the context with the authority of an instruction. The case therefore belongs to the Knowledge layer.

Access Control is the secondary layer: Codex rewrote its global config without human approval, turning one session’s mistake into machine-wide persistence; Claude Code does have a human approval gate, but the long-document framing got the write through about half the time. What stopped the real attack was not the agent but third-party egress and install monitoring.

Don’t launch agents in junk folders: never use Downloads or the desktop, where outside files pile up, as a working directory; launch only inside a defined project folder.

Treat instruction files as outside input: an AGENTS.md or CLAUDE.md of unknown origin in the working folder should not take effect automatically; have a person look first.

Approve and watch config writes: require human approval for any agent write to global config or project settings, and regularly check config for unfamiliar tool-server entries and API addresses.

Keep a second line on egress and installs: route package installs and outbound calls through monitoring or an allowlist rather than trusting the agent.