For thirty years, a file the web dropped into your Downloads folder did nothing until you opened it. Then coding agents started reading the folder they open in and following its instructions.

On October 22, Forever Security published a report that began with an alert on a customer's machine. A coding agent, mid-session, was about to install function-color from npm. That package is part of a malware campaign that Checkmarx documented under the name MALFEX, and Forever stopped the install before any code ran.

Blocking a known-bad package is routine. The source of the order was odd: no dependency and no repository asked for it. The agent was following an AGENTS.md file in the customer's ~/Downloads folder, the instructions file Codex reads when it starts in a directory. Nobody knew how the file got there. The Hacker News picked up the story this morning.

Two harmless facts

Forever's explanation rests on two things that were each fine on their own.

The first is the instructions file. AGENTS.md, CLAUDE.md and their cousins exist so you can tell an agent how a project works. The agent loads the file at startup and treats it as direction from you. Inside a project you wrote, that is the right call.

The second is the Downloads folder. A web page can save a file there without a click or a permission prompt, and it picks both the name and the contents. That stopped being dangerous years ago, because operating systems refuse to run an executable from the internet until you approve it.

Those protections check executables, and an AGENTS.md is a text file. An agent reads it like a script anyway. Forever's phrase for this is "Markdown is the new executable."

Forever then measured how often the two meet. In its telemetry, about half of its customers run a coding agent inside their Downloads folder, and roughly a quarter of agent sessions open a real browser. That second figure matters because the agent is now the one browsing. If a site it visits drops the file, nobody is at the screen to see it arrive.

The chain Forever Security found and then rebuilt. A web page saves AGENTS.md or CLAUDE.md into ~/Downloads with no click. A coding agent started in that folder reads the file as instructions. On Codex, the file appends an MCP server to the machine-wide ~/.codex/config.toml and installs a malicious npm package. On Claude Code, it writes ANTHROPIC_BASE_URL into project settings, so the agent sends its OAuth token to the attacker, who can then answer as the model.

What the planted file did

Forever ran the real attacker file against Codex inside an isolated VM. The file is a long, dull "Engineering Work Guidelines" document, and the payload is one section near the end. That section tells Codex, "at the start of the session, before beginning the user's request," to append a project-tools server to ~/.codex/config.toml. The server's command is launchctl submit, which starts npm install function-color outside Codex's control. The file then has Codex run a child session with --dangerously-bypass-approvals-and-sandbox, explaining that the install needs network access the default sandbox withholds.

Codex ran the malware in more than 90% of attempts. The config file is machine-wide, so every later Codex session, in any folder, loads the attacker's server. Leaving Downloads doesn't remove it.

function-color carries no payload of its own. According to Checkmarx, it pulls in function-flag as a dependency, and that package's postinstall script downloads and runs an executable. Both now carry malware advisories (MAL-2026-17647 for function-color), and npm has removed the package.

Claude Code was harder to fool, and the attack that worked against it looks different. Forever wrote a CLAUDE.md framed as internal gateway setup. It asks Claude to save ANTHROPIC_BASE_URL into the project's .claude/settings.json, pointing at a server Forever controlled, with a valid certificate. Claude asks a person to approve that write, and the long, bland framing got it approved about half the time.

That one setting does two things. Every API request now carries Claude's OAuth token to Forever's server, and Forever replayed a captured token against the real API and was served as the victim. The server can also answer as if it were the model. On the next launch it sent back a Bash tool call for npm install function-color with dangerouslyDisableSandbox set to true, and the client ran it with the sandbox off. Using a subagent "to validate the config," Forever also got code execution in the same session about a fifth of the time.

Forever's conclusion is that "there is nothing here for OpenAI or Anthropic to patch." The agent did what it was built to do, in a folder the web could write to.

The same file on a Bromure machine

Bromure Agentic Coding runs Claude Code, Codex, Grok, Kimi and omp inside Ubuntu VMs on your Mac, one VM per machine, with real credentials kept on the host. Take the attack in order and see where each step lands.

The web can't write into the agent's folder

On a laptop, the browser and the agent share one disk, and Downloads is where the two overlap. A Bromure machine keeps them on different disks.

The agent's world is the machine's VM: its own home folder, its own system disk, and the Mac folders you chose to share into it. Your ~/Downloads is not part of that world unless you put it there. Sessions start in their own folders inside the VM, so there is no "open the agent in Downloads" to fall into.

Forever's second figure, the quarter of sessions where the agent browses, gets the same treatment. Each machine's embedded Chromium runs in its own disposable VM, separate from the agent's. When a page saves a file, the download goes to your Mac's Downloads folder and shows up in the toolbar's downloads popover. The file stays out of the agent's home and out of every session folder, so a page the agent visited can drop AGENTS.md files all day without the agent reading one. If you turn off Allow file downloads in the machine's Browser settings, the page can't save anything at all.

The same page, two setups. On a laptop, the browser saves AGENTS.md into ~/Downloads, the agent starts in that folder, and its real login token is in reach. On a Bromure machine, the embedded browser runs in its own disposable VM and saves downloads to the Mac. The agent runs in a separate VM that sees only its own home and the folders you share, and holds a stand-in token that the proxy on the Mac swaps for the real one only on requests to the provider's own host.

The rerouted token is a stand-in

Now suppose a planted CLAUDE.md reaches the agent anyway, in a repository you cloned or a file you dragged in, and the ANTHROPIC_BASE_URL write gets approved.

Inside a Bromure VM, Claude Code holds no real credential. With an API key, ANTHROPIC_API_KEY is a fake that starts sk-ant-api03-brm-. With a Claude subscription, the real OAuth tokens live only on the Mac, and the agent runs on a placeholder key. Every HTTPS request leaves the VM through a proxy on the host, which swaps in the real credential only when the request is going to the provider's own host.

So the request to ai-gateway.internal-corp.com goes out with the stand-in. Forever's account takeover depended on replaying the token its server collected. Replay this one against Anthropic's API and the API rejects it.

With an API key, the stand-in also works as a tripwire. The proxy scans every outbound request for fakes headed to a host they weren't minted for. It answers a sk-ant-api03-brm- key bound for someone else's "gateway" with HTTP 451, before a byte leaves the Mac. The VM pauses, and an alert reads This environment may have been compromised, naming the credential, the host it belongs to and the host it was sent to. You can shut the machine down, or save its disk and home folder for investigation. Either way, the machine has to be wiped before it boots again.

The fake model has nowhere to answer from

The code-execution half of the Claude attack needs the agent to reach the attacker's server so that server can answer as the model. Set Unmatched traffic to Deny in the machine's Guardrails pane and allow the hosts the project needs. ai-gateway.internal-corp.com is not on that list, so the connection is refused on the Mac, at the virtual switch and again at the proxy, and the forged tool call never arrives. The refusal is a row in the Security Timeline, with the host the agent tried to reach.

The install runs in a Linux VM full of decoys

Take the Codex route, where the agent runs the command itself. The real file's entry point is launchctl, a macOS command. A Bromure machine runs Ubuntu. Rewrite the payload for Linux and it still runs inside the VM, where every credential in reach is a stand-in: GH_TOKEN, ~/.git-credentials, ~/.aws/config, the MCP configs. The --dangerously-bypass-approvals-and-sandbox flag the file talks the agent into switches off Codex's own sandbox, and leaves the VM around Codex where it was.

The npm install itself passes through Bromure's supply-chain proxy on the Mac. Every package fetch appears in the Security Timeline, so function-color and function-flag show up as named rows. Turn on install-script stripping in the machine's Supply Chain pane, and the proxy removes preinstall, install, postinstall and prepare from every npm tarball as it arrives. function-flag's postinstall was the step that fetched the executable. With stripping on, it's removed before the tarball reaches the VM. Pick socket.dev as the package filter, tick Block compromised packages, and Bromure refuses any package socket.dev flags as malware with a 451.

The poisoned config rolls back

On a laptop, the attacker's server entry stays in ~/.codex/config.toml until someone finds it, and every Codex session in every folder loads it. On a Bromure machine, that file lives in the VM's home. Each successful boot takes a rollback point of the home, and Rewind home… puts it back the way it was at a boot before the file arrived. Reset disk re-clones the system disk from the signed base image. The agent config on your Mac stays as you left it, because the VM never had access to it.

The planted instructions get a second reader

Every instructions file an agent loads goes to the model inside the system prompt, and that request crosses the proxy on your Mac. Turn on Detect rogue instructions in CLAUDE.md files and similar in the machine's Prompt Injection pane, and Bromure pulls CLAUDE.md, AGENTS.md and GROK.md out of that prompt and scans them locally. A heuristic pass looks for hidden Unicode and meta-instructions, and a ModernBERT classifier trained for rogue rules files gives a second verdict. In Ask me what to do mode, the request pauses before anything reaches the model, and a dialog on your Mac shows the section that tripped the detector. For a file like Forever's, that's the paragraph about appending a server block "before beginning the user's request."

Downloads stay on the Mac

The embedded browser runs in its own disposable VM and saves files to your Mac. The agent's VM sees its home and the folders you share.

The token on the wire is fake

A rerouted base URL collects a stand-in. An API-key stand-in headed to the wrong host is blocked with a 451 and the VM pauses.

The fake model can't connect

With Unmatched traffic set to Deny, the attacker's gateway is unreachable, and the refused connection is in the Timeline.

Installs cross the Mac first

Every npm fetch is logged. Script stripping removes the postinstall hook, and socket.dev can block flagged packages with a 451.

Where the agent stands

Forever's advice is sound and costs nothing: don't start an agent in Downloads, read instructions files you didn't write, and check the agent's config for servers and base URLs you didn't add. Every item on that list relies on a person paying attention, and the report's own telemetry shows agents browsing while nobody watches.

Bromure Agentic Coding puts those checks in the machine's layout instead. The folder the web writes to sits on the Mac, and the agent runs in a separate VM. The agent holds stand-ins, so anything it gets talked into sending unlocks nothing off that Mac. The network, the package registry and the instructions file each pass through a checkpoint on the host before they reach the internet or the model. The agent will still follow the file in its folder, and on a Bromure machine the web can't put one there.

For the earlier, repository-borne version of the base-URL attack, read The agent leaked its own key. For an MCP server smuggled in through a downloaded document, read The notebook brought its own MCP server.