AGENTS.md Hijacked Codex:
Anatomy of a Real Attack
Researchers found a malicious agent-instructions file on a real customer's computer. In controlled tests, that file persuaded OpenAI Codex to change its global configuration and run a malicious npm package. The story is serious—but the observed incident, the reconstructed browser-delivery route, and separate Claude Code proof of concept must not be conflated.
Executive summary: what was actually observed?
On October 22, 2026, Forever Security researchers Gal Weizman and Omer Samet published their original investigation. Forever's security product detected an AI coding agent attempting to install function-color, a malicious npm package. The instruction source was a roughly 13 KB AGENTS.md file inside the customer's ~/Downloads directory. The defender blocked the attempt before the malicious code executed on that customer's machine.
Investigators could not establish how the file reached Downloads. Their explanation—that a web page can quietly place a file in the downloads directory—is an experimentally demonstrated delivery possibility, not confirmed provenance for the observed incident. Nor does the report establish a broad campaign of successful infections.
01 / The attack chain
A normal instruction file became a route to system-level side effects, provided the agent was launched in the affected directory and followed the planted guidance.
A file sits in Downloads
A plain-text AGENTS.md arrives in a directory the user may ask an assistant to organize. Its arrival method in the real incident remains unknown.
Codex reads project instructions
When run in that trusted directory, Codex treats the applicable Markdown file as working guidance. The malicious section is disguised as routine developer-environment setup.
Global MCP configuration changes
The instructions tell Codex to register a purported project-tools server in ~/.codex/config.toml, a configuration file shared across future sessions—not just this folder.
An installer runs
The registered startup command attempts to install function-color. The payload also prompts a fresh Codex session with safety checks disabled to complete initialization.
The actual attacker document used macOS-specific startup tooling. This is not evidence that the identical payload executes unchanged on Windows or Linux.
02 / Why the malicious instructions looked legitimate
The attack wasn't an obvious one-line demand to install malware. The recovered AGENTS.md resembled ordinary engineering documentation. Near the end, a section framed the package as a standard MCP helper needed to begin development. It told Codex to preserve existing settings, append a plausible tools-server registration, verify initialization, and then proceed with the user's original request.
That framing matters. The payload combined three trust-boundary crossings: untrusted file → agent instruction → persistent machine configuration. A fourth step escalated privileges by instructing the agent to create a new Codex process using flags that bypass its normal approval and sandbox controls.
Forever reported that getting the full chain to complete involved several conditions: Codex had to trust the working directory; configuration writes had to be accepted; the new server needed a fresh session to load; network access had to be available for package installation; and the installation had to survive the MCP startup handshake timeout. The real payload used a background system launcher to avoid that final timeout.
~/.codex/config.toml.03 / How convincing were the tests?
| Real incident | Forever observed and blocked a Codex-initiated attempt to install function-color. The installation did not execute on the protected endpoint. |
| Codex test | Researchers reused the real recovered AGENTS.md. They report the attack chain worked in more than 90% of trials. Most executions used a harmless calculator-opening substitute; the actual malicious package was executed once in an isolated VM. |
| Claude Code test | Researchers separately constructed a malicious CLAUDE.md. Claude followed their configuration-change chain about 50% of the time, according to Forever. This is not evidence of an observed Claude Code victim. |
| Same-session Claude | In roughly one fifth of tests, a fresh subagent connection allowed code execution before the original session ended. |
| Unverified | Initial delivery to the real customer's Downloads directory, total affected users, and independently replicated success rates. |
Success rates are the researchers' own reported test outcomes, not universal probabilities for every agent version, operating system or configuration. BleepingComputer and CSO separately reported the disclosure; neither published an independent reproduction of every test.
04 / The separate Claude Code token-theft experiment
To determine whether this was specific to Codex, Forever created a different payload in CLAUDE.md. It posed as a legitimate company model gateway and asked Claude Code to create .claude/settings.json with a modified ANTHROPIC_BASE_URL. The URL directed model traffic through a researcher-controlled HTTPS endpoint.
Once the new configuration was used, the endpoint received the agent's OAuth token along with API traffic. Forever says it replayed a captured token against Anthropic's actual API and successfully authenticated as the test user. It could also impersonate model responses and return executable tool calls. A newly spawned subagent could connect to the new endpoint in the same session; otherwise, the rerouting took effect upon a subsequent session.
The initial configuration write succeeded in approximately 50% of their tests; same-session execution succeeded in about 20%. These are distinct measurements. The report says captured research tokens were rotated.
05 / Does merely visiting a website compromise Codex?
No. The proposed website-to-Downloads route has important prerequisites. A webpage may trigger a download without the user intentionally choosing that file, depending on browser behavior and configuration; the resulting file must land with a recognized name in a directory the agent later opens; and the agent must load and follow it with sufficient filesystem, process and network permissions.
Forever recreated the full path in its testing and noted that agents often work in Downloads, including during file organization tasks. The company's own telemetry suggested approximately half of its customers run a coding agent inside Downloads, and about a quarter of agent sessions open a real browser. These figures describe Forever's observed customer environment, not all Codex users.
The original publication argues that this is a design-level trust-boundary problem rather than a conventional software vulnerability. That is the researchers' assessment—not an official statement that every product configuration is equally vulnerable or that further mitigations are impossible.
06 / What to inspect now
- Working directory. Avoid starting coding agents inside Downloads or other folders populated by untrusted external material. Use a reviewed project directory.
- Instruction files. Read unexpected
AGENTS.md,AGENTS.override.mdandCLAUDE.mdbefore granting agents access. Inspect newly cloned repositories as well. - Codex configuration. Review
~/.codex/config.toml(on Windows, the corresponding file beneath your user profile) for unfamiliar[mcp_servers.*]entries, executable commands and unexpected API endpoints. - Claude Code configuration. Review project
.claude/settings.jsonfor unsolicitedANTHROPIC_BASE_URLvalues or unrecognized network gateways. - Execution approvals. Keep sandboxing and approval prompts enabled. Instructions requiring bypass flags, automatic installers, background launchers or new network endpoints deserve independent human review.
- Incident response. If you find an unauthorized server or suspicious package installation, stop agent sessions, investigate the host and treat potentially exposed tokens as compromised; revoke or rotate them from a clean environment.
Indicator identified in the report: function-color (malicious npm package, reportedly removed from the registry). Its presence in local installs merits urgent investigation. The named package is a campaign indicator, not a test you should attempt to install.
07 / The larger lesson
Repository instruction files are useful precisely because agents read them early and rely on them for task context. OpenAI's official Codex guide describes AGENTS.md as persistent project guidance, while OpenAI's MCP guidance warns about prompt injection when tools have access to sensitive data or actions.
That is the fundamental distinction: instructions in a downloaded document are data from an untrusted source, not permission to reconfigure the host. A practical defense must enforce that boundary with directory isolation, privilege limits, checks before config writes, and review of new executable integrations—not merely hope that the model recognizes deceptive prose.
Original sources and independent reporting
- Forever Security — original technical disclosure (Oct 22, 2026). Gal Weizman and Omer Samet; primary evidence, screenshots, attacker document excerpts, experiment design, rates, limitations, and defensive recommendations.
- OpenAI — official Codex project-instructions guidance. Confirms how
AGENTS.mdis used for persistent repository instructions. - OpenAI — official MCP documentation for Codex. Describes local MCP registration and
config.toml. - OpenAI — official MCP security and approval guidance. Context on tool permissions and prompt-injection risks.
- BleepingComputer — reporting and researcher interview (Oct 25, 2026). Independent coverage, delivery prerequisites and operational context.
- CSO Online — independent reporting (Oct 26, 2026). Summarizes trust boundaries, Codex configuration persistence and test constraints.
- Help Net Security — additional reporting (Oct 26, 2026). Separates benign stand-ins from the one isolated live-malware execution and describes the Claude proof of concept.