Never start Codex in your Downloads folder: a planted AGENTS.md there got Codex to install real npm malware

#What changed

In an Oct 22 report, Forever Security researcher Gal Weizman (@WeizmanGal) described stopping an agent mid-session as it tried to install function-color, a malicious npm package tied to the MALFEX campaign. The instruction was buried in a long, ordinary-looking "Engineering Work Guidelines" AGENTS.md in the customer's Downloads folder. Forever doesn't know how the file got there; its theory is that Downloads is the one folder a web page can save a file into without a click, depending on browser settings. When Forever replayed the real file on Codex in an isolated VM, it told Codex to add a "project tools" MCP server to the global ~/.codex/config.toml and run a check with approvals and sandboxing bypassed, which installed the malware. Because that config is global, every later Codex session on the machine loads the attacker's server, in any folder. A Skimwire write-up puts Codex's success rate in Forever's tests at over 90%. Forever built a similar CLAUDE.md for Claude Code that worked about half the time and leaked its login token. Forever says neither tool has a bug to patch; the agents are doing what they're built to do.

#Who is affected

Anyone who launches Codex CLI (or Claude Code, or another agent that reads AGENTS.md or CLAUDE.md) from a terminal that happens to be sitting in ~/Downloads, or in any folder holding files they didn't write, such as a freshly cloned repo or an unzipped archive. Forever says about half of its customers have run a coding agent inside Downloads.

#What to do now

• Don't start Codex in ~/Downloads. Move the files you need into a real project folder first.
• Read any AGENTS.md or CLAUDE.md you didn't write before letting an agent work in that folder, including in repos you just cloned.
• Open ~/.codex/config.toml and look for [mcp_servers.*] blocks you didn't add. For Claude Code, check .claude/settings.json for an ANTHROPIC_BASE_URL or proxy you didn't set.
• Keep approval prompts and the sandbox on, and treat any instruction file that tells the agent to bypass them as hostile.
• If function-color ever shows up in a machine's installs, treat the machine as compromised and rotate your tokens. Deleting the AGENTS.md won't undo config changes the agent already made.

#What is not confirmed

The live incident, the reproduction and the success rates come from Forever's own report and telemetry; DotsFeed has not independently reproduced them. How the file reached the customer's Downloads folder is Forever's theory, not established. The 90%+ figure for Codex comes from Skimwire's summary of Forever's tests.