Start the coding agent in the project, not in Downloads

Verdict, October 27, 2026. OP to start Codex, Claude Code, Cursor, Antigravity, and Copilot inside a project folder you wrote, and to read any AGENTS.md, CLAUDE.md, or GEMINI.md you did not write before the agent does. Mid to treat a trust dialog, a sandbox, or an approval prompt as proof that ~/Downloads is a safe working directory. The vendor pages below describe loading those files as normal behavior. No letter moves on the AI Coding Agents board. S stays locked. OP or Mid has not reproduced the report and has not started an agent in Downloads.

Pages below were read October 27, 2026. Rates and telemetry are Forever Security's claims, or a newsroom's account of them. How a product loads a file is a vendor claim.

What was found

NEW Forever Security's October 22, 2026 post says it found a malicious AGENTS.md in a customer's ~/Downloads and stopped the coding agent before any code ran. The file was dressed as engineering notes and pointed Codex at the npm package function-color. Forever says it could not tell how the file arrived. It built a download page, and it says it did not establish that page as the customer's path. The npm page, read October 27, says function-color contained malicious code, was removed by the npm security team, and remains as placeholder 0.0.1-security. Sources: Forever Security (opens in a new tab), function-color (opens in a new tab).

VENDOR CLAIM Forever says Codex followed through in more than 90% of attempts and Claude Code about half the time, that most attempts used a harmless stand-in, and that the real package was run once in a VM. BleepingComputer on October 25 describes the Codex figure as a calculator reconstruction at 90%. The sentences do not match, and this article does not pick one. The Hacker News on October 26 quotes Forever's view that there is nothing for OpenAI or Anthropic to patch. Forever's own telemetry sentence is "about half" of customers and "about a quarter" of sessions. BleepingComputer separately reports a researcher putting Claude Code alone above 1,300 Downloads sessions. BleepingComputer's check of the page saved a harmless file; Chrome, Edge, and Firefox skipped the save-location prompt and still showed a download notification, and Brave asked. Sources: Forever Security (opens in a new tab), BleepingComputer (opens in a new tab), The Hacker News (opens in a new tab).

What the working directory loads

NERF ~/Downloads is not an ancestor of ~/projects/app. It is on the walk when you start there.

Agent	Loaded from where you start	What the docs hold back
Codex	`~/.codex/AGENTS.override.md` if it exists, otherwise `~/.codex/AGENTS.md`. Then one file per directory from the project root down: override, else `AGENTS.md`. No root means the current directory only. Cap 32 KiB.	Untrusted skips project `.codex/` config, hooks, and rules. Those pages do not name `AGENTS.md` in the skip. User `config.toml` still loads.
Claude Code	`CLAUDE.md`, `.claude/CLAUDE.md`, and `CLAUDE.local.md` from the working directory and every parent. `AGENTS.md` on that walk when none of those are present. Direct reads need v2.1.277+.	The trust table does not list those files. Project `env` applies after trust, and at startup in `-p`.
Cursor	Root and nested `AGENTS.md`. Nearer wins. Rules in `.cursor/rules`.	Workspace trust is off by default and is not described as dropping `AGENTS.md`.
Antigravity	`AGENTS.md` or `GEMINI.md`, and `.agents/rules`, up to the workspace root when a file is read or edited. Global `~/.gemini` files too. `AGENTS.md` stays on for its directory.	Rules and permissions pages do not say those files are skipped.
Copilot	CLI: `AGENTS.md`, `CLAUDE.md`, or `GEMINI.md`, plus `.github` and `~/.copilot` files. VS Code Chat: `AGENTS.md`. Cloud agent: the same names in the repo. Nearest `AGENTS.md` wins.	The support page does not describe a check that drops a file you did not write.

Sources, in row order: Codex AGENTS.md (opens in a new tab), Codex project config (opens in a new tab), Claude memory (opens in a new tab), Claude permissions (opens in a new tab), Cursor rules (opens in a new tab), Cursor agent security (opens in a new tab), Antigravity rules (opens in a new tab), Antigravity permissions (opens in a new tab), Copilot instruction support (opens in a new tab), Copilot repository instructions (opens in a new tab).

Where the dialog stops

BUFF Codex's default local sandbox has network access off. Auto can edit and run commands in the working directory, and it asks before network access or an edit outside it. --dangerously-bypass-approvals-and-sandbox (--yolo) turns both off. The docs say to use caution. Project .codex/config.toml loads only when the project is trusted, and it cannot set openai_base_url, chatgpt_base_url, or model_providers. trust_level = "untrusted" skips project .codex/ layers. The configuration reference does not say it skips AGENTS.md. Forever says Codex obeys that file only in a trusted project, and that having worked in Downloads qualifies. That sentence is Forever's. Sources: Approvals (opens in a new tab), Advanced configuration (opens in a new tab), Configuration reference (opens in a new tab), Forever Security (opens in a new tab).

NERF Claude Code's trust dialog lists the allow rules and extra directories the folder would grant. Home-directory trust is not saved. A project env block, whose documented example sets ANTHROPIC_BASE_URL, applies after you trust the workspace, when you have trusted only a parent, and at startup in claude -p with no dialog. --bare still applies it. --setting-sources user skips project settings and .mcp.json. A settings-file value overrides the shell in most sessions. /status shows the base URL. managed-only in /config leaves out project, user, and local CLAUDE.md files and every AGENTS.md at launch. A subdirectory CLAUDE.md can still load when a file there is read. Sources: Permissions (opens in a new tab), Security (opens in a new tab), Settings reference (opens in a new tab), LLM gateway (opens in a new tab), Memory (opens in a new tab).

Cursor reads files without approval. Configuration-file edits, and terminal commands by default, need approval. Each MCP connection needs approval, then each tool call, unless you allowlist one. For an untrusted repo the security page says to use a text editor. Restricted mode breaks AI features. Source: Agent security (opens in a new tab).

Antigravity Request Review always asks and limits files to the workspace. Default and Auto (Preview) allow sandboxed commands and ask for MCP and web. Turbo disables the sandbox and opens the full filesystem. Auto (Preview) starts in app v2.23.0 and is withheld from business and enterprise accounts. None of that skips AGENTS.md. Sources: Permissions (opens in a new tab), Rules (opens in a new tab). CLI Auto asking less often is the October 26 note, from CLI 1.4.7 (opens in a new tab).

Copilot's cloud agent reads the files from the assigned repository. It does not read local Downloads unless that file was committed. The local CLI, and a VS Code workspace opened on Downloads, are the rows that can. Source: Instruction support (opens in a new tab).

Start in the repo

BUFF OP when the working directory is the repository you mean.

cd into the repo, then start the agent. Codex: codex --cd that path, then codex status. Stop if the root is wrong. A start inside ~/Downloads whose first .git is $HOME includes files from home down through Downloads. Sources: AGENTS.md (opens in a new tab), Project root (opens in a new tab).
Claude Code: start in the project, not $HOME. Decline a trust dialog whose allow rules or directories you do not recognize. For a script, claude -p --setting-sources user. --bare is not that skip. /context lists memory files. Sources: Permissions (opens in a new tab), Memory (opens in a new tab).
Cursor: open the project folder. For a tree you do not trust, use a text editor. Source: Agent security (opens in a new tab).
Antigravity: leave Turbo off. Request Review asks before every terminal command. Source: Permissions (opens in a new tab).
Copilot: run the CLI from the repository. Before a cloud-agent assignment, read that repo's AGENTS.md, CLAUDE.md, and GEMINI.md. Source: Repository instructions (opens in a new tab).

Read any AGENTS.md, AGENTS.override.md, CLAUDE.md, CLAUDE.local.md, GEMINI.md, or .github/copilot-instructions.md you did not write, including one sitting in Downloads. In ~/.codex/config.toml, look for an mcp_servers table, openai_base_url, or chatgpt_base_url you did not set. In .claude/settings.json and .claude/settings.local.json, look for an env value, including ANTHROPIC_BASE_URL, you did not set. Leave --dangerously-bypass-approvals-and-sandbox and --dangerously-skip-permissions off. A file that tells the agent to turn one on is a reason to stop the session. If you find a file you did not write, Forever says to assume the login token leaked and rotate it. This article did not find an OpenAI or Anthropic page that names this report as that step. Sources: Codex project config (opens in a new tab), Codex approvals (opens in a new tab), LLM gateway (opens in a new tab), Antigravity permissions (opens in a new tab), Forever Security (opens in a new tab).

The board stays on October 15

No letter moves. Codex, Claude Code, Antigravity, and Cursor stay in A on the October 15 AI Coding Agents list. The docs describe the file load as the feature. Continue CLI stays in C for CVE-2026-109560, a different bug. The F row is still the playstyle with live web, form access, and no sandbox. Starting in Downloads is a working-directory mistake, not a new rank. S stays locked.

What to do today

Start in the repository. Do not start in ~/Downloads or $HOME.
Check codex status or Claude Code's /context before the task. For claude -p, add --setting-sources user.
Decline a trust dialog that names allow rules or directories you did not write.
Check ~/.codex/config.toml and .claude/settings.json for a base URL or MCP server you did not add. Leave the bypass flags off.
Do not open an untrusted tree in Cursor. Do not use Antigravity Turbo on one. Read a Copilot repo's instruction files before you assign the cloud agent.

The weekly patch is on beehiiv: subscribe free (opens in a new tab).

The OP or Mid Team

Sources

Checked October 27, 2026.