Ordinary-looking text can request extraordinary access
Forever Security reported October 22 that it found a malicious AGENTS.md file in a customer’s Downloads folder directing a coding agent to install a malicious package. The company says it blocked the installation before code ran on that customer’s machine. Its subsequent testing reproduced a chain involving changes to Codex configuration; separate tests used a crafted CLAUDE.md file to redirect Claude Code’s API traffic. The real-world finding and the laboratory demonstrations should be kept distinct. The report does not establish that every agent, configuration or downloaded instructions file produces the same outcome.
The trust decision precedes the command
The researchers describe a dangerous combination: downloaded content in a working folder and an agent treating a local instructions file as authoritative. Their Codex testing required the folder to be trusted. They also report that the wording and surrounding context influenced whether the agent followed the malicious directions. The meaningful security question is therefore broader than whether a text file can execute by itself. It is whether software with permission to act on the user’s behalf can be persuaded to translate an untrusted instruction into a configuration change. Forever’s results are vendor-reported research; this publication has not independently reproduced the experiments.
Separate imported material from project authority
For a school using coding assistants or a small business adopting them without a dedicated security team, a practical operating rule is to keep Downloads out of the set of trusted project workspaces. Forever recommends reviewing unexpected AGENTS.md and CLAUDE.md files, checking agent configuration for unfamiliar servers or API endpoints, and retaining sandbox and approval controls. Our analysis is that importing a project should include an explicit review of instructions that can affect the assistant’s behavior. A familiar filename is not evidence that the person requesting the work approved its contents. The review should focus particularly on requests to alter account-wide settings or weaken execution controls.
Make configuration changes visible to the owner
A useful deployment process records the approved tool servers and service endpoints for each managed assistant. Our recommendation is to give configuration changes the same accountable ownership as other software integrations: who requested the change, what service receives the connection and which work requires it. That record makes an unexpected addition easier to investigate. Where suspicious instructions are found, follow the researcher’s guidance to assess token exposure and replace affected credentials; confirmed installation of the identified malicious package warrants treating the machine as compromised. Do not equate discovery of a text file with proof of every possible downstream action. Preserve the relevant settings and execution evidence so responders can establish what actually happened and scope recovery accordingly.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
