BleepingComputer reports that Forever Security found a malicious AGENTS.md in a customer’s ~/Downloads folder, which was also the coding agent’s working directory. The agent read the file and tried to install a rogue npm package called “function-color.”
The researchers reproduced it against OpenAI Codex, and showed a related trick against Claude Code that leaked OAuth tokens. Their point: “There is nothing here for OpenAI or Anthropic to patch.” The agent is doing what it was built to do.
A quick checklist
- Don’t start agents in Downloads or any folder full of random files.
- Check for AGENTS.md, CLAUDE.md and similar files in any folder before you point an agent at it.
- Keep package installs and shell commands behind approval prompts.
- Keep tokens scoped and rotate them if something looks off.
God Bless, and Needs Garlic!
