Malicious AGENTS.md dropped via browser download led Codex to install malware in over 90% of tests

Security firm Forever Security stopped a coding agent on a customer's machine from installing function-color, a known malicious npm package, after an AGENTS.md file in the ~/Downloads folder instructed it to do so. Researchers found that Chrome, Edge, and Firefox can save such a file to Downloads without user confirmation when a web page triggers it, while Brave is the exception that prompts first. The planted file disguised the payload as routine environment setup, adding a Codex server entry that runs the install through macOS launchctl outside the agent's control. In tests, Codex executed the payload in more than 90% of attempts, and the malicious config persists across all later sessions on the machine. The findings were published October 22 and reported by BleepingComputer.