Downloads guard: 3 checks to run tonight (+3 more) so a file a website drops can't steer your coding agent

On Oct 22, 2026, Forever Security reported live malware on a real customer's machine: an AGENTS.md in the Downloads folder had turned the customer's own coding agent against them. In their tests Codex followed a planted file in more than 90% of attempts, and Claude Code about 50% (Claude needs a human to approve the settings change). They also found that about half of their customers run a coding agent inside Downloads. Their view: there is nothing for OpenAI or Anthropic to patch, so the fix is on your side.

The 6 checks

1. 01

   Never start an agent in Downloads, or in any folder inside it

   Why: Claude Code reads CLAUDE.md files from the folder you start in and every folder above it. So a project folder that lives inside Downloads still loads a CLAUDE.md sitting in Downloads itself. Since v2.1.277 it also reads AGENTS.md when no CLAUDE.md is found. Forever's own advice: don't start Codex, Claude Code or any agent in Downloads.

   Check it: Move projects out of Downloads (for example to ~/code). Then check Downloads for instruction files you didn't put there. No output means none were found. If something turns up, open it in a text editor and read it before you run any agent nearby.

   find -E ~/Downloads -maxdepth 2 -iregex '.*/(agents|claude)(\.local)?\.md'
2. 02

   Say no to settings changes you didn't ask for

   Why: In Forever's Claude Code test, the planted file asked Claude to write a .claude/settings.json that sent its API traffic to another server, which exposes your login token. Writes to .claude are protected paths: Claude Code asks you first in the default and acceptEdits modes, auto mode sends them to its classifier, and bypassPermissions allows them silently.

   Check it: If Claude asks to edit its own settings and you didn't ask for that, choose No. Be most suspicious of an ANTHROPIC_BASE_URL or proxy setting you didn't add. To make Claude always ask, even in auto mode, add an ask rule (explicit ask rules are never auto-approved) to ~/.claude/settings.json.

   "permissions": { "ask": ["Edit(**/.claude/settings.json)", "Edit(**/.claude/settings.local.json)", "Edit(**/.mcp.json)"] }
3. 03

   Turn on the sandbox and switch off its escape hatch

   Why: The sandbox is off by default. When a command fails inside it, Claude can retry it outside with dangerouslyDisableSandbox. With allowUnsandboxedCommands set to false, Claude Code ignores that parameter. failIfUnavailable stops Claude Code from quietly running without the sandbox when it can't start.

   Check it: Run /sandbox once inside Claude Code, or add this to ~/.claude/settings.json. macOS needs nothing extra. Linux and WSL2 need bubblewrap and socat. Native Windows has no sandbox; use WSL2.

   "sandbox": { "enabled": true, "allowUnsandboxedCommands": false, "failIfUnavailable": true }sudo apt-get install bubblewrap socat
4. 04

   Tell Claude Code to skip instruction files in Downloads

   Why: claudeMdExcludes skips CLAUDE.md files that match a path pattern (docs). Put it in your user settings so it applies to every project. A belt to go with the braces above, not a replacement for them.

   Check it: Add this to ~/.claude/settings.json. Patterns match absolute paths with glob syntax. The docs describe this setting for CLAUDE.md files; whether it also skips AGENTS.md isn't clearly stated, so don't rely on it for that. It does nothing for Codex.

   "claudeMdExcludes": ["**/Downloads/CLAUDE.md", "**/Downloads/CLAUDE.local.md", "**/Downloads/.claude/CLAUDE.md", "**/Downloads/AGENTS.md"]
5. 05

   Turn off bypass mode for yourself

   Why: bypassPermissions skips the prompts that would have stopped the settings change. disableBypassPermissionsMode works from any settings file, so you can lock yourself out of it. For Codex, don't run it with --dangerously-bypass-approvals-and-sandbox: in Forever's test the planted file got Codex to start a second copy of itself with that flag.

   Check it: Add this to ~/.claude/settings.json.

   "permissions": { "disableBypassPermissionsMode": "disable" }
6. 06

   Check what your agents already have

   Why: If a planted file already ran, it may have left changes behind. Forever's detection tips: a project .claude/settings.json with an ANTHROPIC_BASE_URL or proxy you didn't set; in ~/.codex/config.toml, an unexpected [mcp_servers.*] block or a changed chatgpt_base_url; and the npm package function-color in your installs.

   Check it: The first command lists Claude settings files under your home folder that set an API endpoint or proxy (no output = none). The second shows the Codex lines worth reading. In Codex, untrusted projects skip project-scoped .codex/ config, so keep Downloads off your trusted list. If anything looks wrong, rotate your logins and tokens from a clean device; a stolen token is a live session.

   find ~ -maxdepth 6 -path "*/.claude/settings*.json" -not -path "*/node_modules/*" -exec grep -l -E "ANTHROPIC_BASE_URL|HTTPS?_PROXY" {} + 2>/dev/nullgrep -n -E "mcp_servers|base_url|trust_level|approval_policy|sandbox_mode" ~/.codex/config.toml

Good to know

• This is a defensive checklist, not a security audit. It covers the gap Forever Security described; it doesn't make your machine safe from everything.
• Merge the settings snippets into one ~/.claude/settings.json (keys like "permissions" combine). Run /status in Claude Code afterwards to confirm the file loaded.
• Facts as of Oct 28, 2026, from the Forever Security post and the Claude Code, Codex and Chrome docs linked above. An overview by @copilot_shogo; not affiliated with Anthropic, OpenAI, Google or Forever Security.