Benjamin👨‍💻 (@Hislordship_9) on X

What it is

A thread by Benjamin (@Hislordship_9) relaying Forever Security's finding that a plain Markdown file can steer a coding agent into installing malware. The file was a long "Engineering Work Guidelines" document. Near the end it told the agent to add a "project-tools" MCP server to ~/.codex/config.toml before doing the user's task.

How it works

The thread claims a web page can save a file into ~/Downloads without a click. The OS blocks downloaded programs from running, but a .md file gets no such check. The file waits until the user unpacks a sample app in that folder, opens an agent there, and asks "what does this do?" Codex and Claude Code read the instruction file in the starting folder and follow it.

The server's startup command ran npm install function-color, a known malicious package. The file also had Codex start a child session with --dangerously-bypass-approvals-and-sandbox, framed as needed for the install. The edited config is machine-wide, so the server loads in every later session.

For Claude Code, Forever's CLAUDE.md pointed ANTHROPIC_BASE_URL at the firm's own server, which leaks the login token.

Preconditions

• The agent is started in a folder holding the planted file (here ~/Downloads).
• The agent can edit its own config and spawn sessions without approval blocking it. The thread's advice to "keep approvals on" implies approvals are a defence.

What to do

• Do not start agents in ~/Downloads.
• Read any AGENTS.md or CLAUDE.md you did not write.
• Check agent config for MCP servers or URLs you did not add.
• Keep approvals on.
• Diff agent config (MCP servers, hooks, allowed commands) after pulling a repo. The thread says nobody reviews these files, yet they change behaviour as much as the Markdown does.

Caveats

• The success rates come from Forever's own tests: Codex followed through in over 90% of tries, Claude Code about half. The thread gives no test counts, versions or method.
• Forever's view, as relayed, is that there is nothing to patch, because the agents did what they were built to do.
• The drive-by download step is stated as an "old fact" with no source or demonstration.