Check instruction files before starting a coding agent

Forever Security reported finding malicious agent instructions in a customer's Downloads folder. The report describes attempts to redirect an agent's configuration and install malware ^[1].

Choose a project directory you control

The researchers recommend avoiding ~/Downloads as an agent's starting directory. Inspect unfamiliar AGENTS.md and CLAUDE.md files before opening their folder with an agent ^[1].

text

AGENTS.md
CLAUDE.md

Read for unexpected installation requests, credential handling or instructions to disable safeguards.

Review configured endpoints

The report names these configuration locations ^[1].

text

~/.codex/config.toml
.claude/settings.json

Check Codex for unfamiliar MCP server entries or a changed chatgpt_base_url. Check Claude Code for an unexpected ANTHROPIC_BASE_URL or proxy. Keep approvals and sandboxing enabled ^[1].

Respond to evidence of compromise

Forever recommends rotating exposed tokens if you discover the malicious configuration. It identifies function-color as a malicious npm package in the campaign; finding it warrants treating the machine as compromised ^[1]. Do not run unfamiliar package commands to investigate them.

You have the instruction files and endpoint settings to review before the next agent session. For repository startup hooks, continue with the unfamiliar repository checklist.