Forever Security says a web page can plant an AGENTS.md or CLAUDE.md file in Downloads that steers Codex and Claude Code into changing their own settings and installing malware, and reports one real sighting

What happened

Forever Security published research on October 22, 2026 saying a web page can silently save a file named AGENTS.md or CLAUDE.md into a user's Downloads folder, and that OpenAI's Codex and Anthropic's Claude Code follow it when started there. In Forever's tests, Codex added an MCP server (a tool connection) to its machine-wide settings and installed a malicious npm package in more than 90% of attempts. Claude Code was steered to write an API address setting that would expose its login token, about half the time. Forever says it found a planted file on a customer's machine and stopped an agent from installing function-color, a package Checkmarx lists in a known malware campaign. How that file reached the machine is not established.

Why it was a problem

A file nobody wrote or approved became working orders for an agent that holds the developer's shell, settings and login token. The changes were made to machine-wide settings, so they would outlast the session. The agents behaved as designed, following instruction files in their folder, so no vendor fix is in view. The evidence is one firm's research and one unnamed customer sighting, and the sighting was caught by Forever's own intervention.

How SAG could have helped

Under the assumptions below, the coding agent's work would be a work class, a defined piece of work with declared steps, such as editing files in one named project and running its tests. The authority envelope, the human grant for that work, would name that project as its scope. Writing to the Codex or Claude Code settings files, adding a tool connection, setting an API address, installing a package and launching a second agent with approvals switched off are separate operations, and none is a declared step, so each would be refused before it ran. Dependencies could be declared as a step limited to an approved package list, which function-color would fall outside, and a gate, the human involvement a step requires, could hold any new package for a named person's decision. Permission attaches to the exact operation and target a person granted, so a file the agent reads, wherever it came from, adds nothing to the grant. The agent would still read the file and still be steered. SAG does not scan files, detect planted instructions or alert anyone, and a refusal does not remove the file.

Assumptions we must make

• The organization defines each coding agent's work as declared steps limited to named project directories and an approved package list, and a person grants it. Settings files and unlisted installs are not steps. (Assumed)
• Every file write, install and process launch by the agent runs through the governed path. Reports indicate the tested agents used direct local shell and file access, so this was not the case. (Contradicted by sources)
• A named person decides on each new dependency or tool connection, and the organization has a way to reach that person before the agent proceeds. (Assumed)

Classification

Category

Disclosed vulnerability

Section

Agent governance

Is update

No

Rank

1

Event date text

Not dated by the source; the real-world sighting has no stated date

Publication date text

2026-10-22 (Forever Security); Checkmarx campaign write-up 2026-10-05

Governance analysis

Intended task

Work on code in whatever folder a developer opens the agent in.

Action taken or attempted

In testing, Codex added an MCP server entry to its machine-wide config, launched a child agent with approvals and sandbox bypassed, and installed an npm package; Claude Code was steered to write an API base URL into its settings. In the one reported real case, an agent was stopped before installing function-color.

Access

Shell, file writes to settings files, package installation and, for Claude Code, its OAuth token.

Authority boundary

Instructions from the developer and their project, versus a file dropped into Downloads by a web page.

Harm or near miss

Potential code execution and account takeover on developer machines. One real planted file was caught before the install. No completed compromise is reported.

Control failure

Instruction files in the working folder were treated as trusted, the agents could change their own settings and install packages, and the web could write the file where the agent would read it.

Control categories

Untrusted input handling, Scope of authority, Action time authorization, Human approval

Diagnosis confidence

Supported inference

Preventive or detective control

Limit the folders an agent may work in, require approval for settings changes and new dependencies, and review instruction files that did not come from the project.

Timeline

• Checkmarx malfex write up: 2026-10-05
• Forever security publication: 2026-10-22
• Real world sighting: Date not stated

Sources

• forever.security
• checkmarx.com

Notes

From sources

• A web page can save AGENTS.md or CLAUDE.md into Downloads without a click (Forever Security).
• Codex ran the payload in more than 90% of attempts and Claude Code followed the config write about 50% of the time, with about a fifth reaching same-session execution (Forever's own testing).
• function-color is listed as a malicious package in the MALFEX campaign (Checkmarx, October 5, 2026).

Inferred

• Declared steps and an approved package list would have refused the settings writes and the install (supported inference from the described actions).

Not established

• How the real planted file reached the customer's machine.
• Agent versions, permission modes and number of trials in Forever's tests.
• Whether OpenAI or Anthropic changed behavior in response.
• Whether any machine was compromised.

Disclaimers

• The SAG section is an architectural counterfactual under the stated assumptions. It is not a claim that Seampoint software operated in the reported environment.
• Reporting is based on public statements and press coverage. Sources may be incomplete, disputed or later corrected, and third-party allegations are unconfirmed unless the operator confirms them.
• SAG is described here by reference to Seampoint's work-class specification, which is an open review draft. It is not an adopted standard, and no production deployment has been qualified against it.