What happened
Forever Security caught a live attack on a customer machine where a coding agent began installing the known-malicious npm package 'function-color' mid-session; tracing showed the triggering instruction came from a 13KB AGENTS.md file that had been silently dropped into ~/Downloads. Because CLI agents auto-load instruction files from their launch directory and browsers auto-save files into ~/Downloads, 'a plain text file becomes an executable.' Forever reproduced the chain on Codex (>90% success) and Claude Code (~50%), and the researchers state the hole has no CVE and neither OpenAI nor Anthropic will patch it, since both the file-following and the browser auto-save are 'working as intended' features.
Why it matters
This is a working, observed-in-the-wild agent-execution attack class that runs code with the user's full privileges. It can plant a persistent malicious MCP server that fires at the start of every future Codex session on that machine, impersonate the model or reroute Claude Code API traffic to exfiltrate OAuth credentials, and reach any secrets the AI coding agent can access — turning the abatement of AI coding assistants into a silent supply-chain and credential-harvesting vector.
Attack vector
A hostile web page silently writes a ~13KB AGENTS.md placeholder text file into the developer's ~/Downloads directory via a standard background download (no clicks, no prompt). When the developer later launches Codex or Claude Code inside that folder, the agent auto-reads the file as trusted project instructions and executes them with the user's privileges — registering a malicious MCP server entry in ~/.codex/config.toml, rewriting ANTHROPIC_BASE_URL in .claude/settings.json (which leaks the OAuth token and reroutes all Claude traffic to an attacker server), and running npm install of the known-malicious 'function-color' package. The attack chain is entirely 'as-designed' behavior on both sides, so it has no CVE and neither vendor will patch it.
Affected systems
OpenAI Codex CLI, Anthropic Claude Code, and similar CLI AI agents that treat CLAUDE.md/AGENTS.md/.mcp.json as trusted instructions; combined with the browser behavior of silently saving downloads to ~/Downloads. No vendor patch (architectural intersection, no CVE).
Mitigation
Never launch coding agents from ~/Downloads or any browser-writable folder; always launch from a clean, project-specific working directory. Treat CLAUDE.md/AGENTS.md/.mcp.json/settings.json as a trust boundary and review them before first run and after each pull. Restrict agent sandbox/approval settings (avoid --dangerously-bypass-approvals-and-sandbox), blocklist the 'function-color' package, and monitor agent-initiated npm installs and settings-file writes.