Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware

A malicious AGENTS.md file that appeared in a developer's Downloads folder tried to turn an AI coding agent into an installer for a known-malicious npm package. Forever Security said it stopped the attempt on a customer's machine before any code ran, and its analysis shows how a web page can plant instructions that an agent will obey.

Malicious instruction file found in Downloads

Forever Security said a malicious instruction file in a developer's Downloads folder tried to make an AI coding agent install a known-malicious npm package. The company caught the attempt on a real customer's machine and stopped the agent before any code ran. It could not determine how the file got into the folder.

The file was AGENTS.md, a plain-text instructions file that a coding agent such as OpenAI's Codex reads when it starts in a folder and follows as directions. It was dressed up as ordinary engineering notes. One section told the agent to add a server to its own configuration and install a package called function-color from npm. That package is part of a malware campaign documented separately: function-color pulls in a downloader called function-flag, which fetches and runs a Windows payload. Researchers at CloudSEK and Checkmarx, who analyzed the campaign, named it MALFEX.

Why the folder matters

Forever said two harmless things make this work. An agent trusts and obeys the instructions file in the folder it opens. A web page can save a file to Downloads on its own, without a click or permission prompt, choosing the name and contents. Together, a web page can drop a file the agent treats as orders into a folder the agent trusts.

Researchers did not establish that this is how the file was caught. Forever built a proof-of-concept page: visit it, and an AGENTS.md downloads silently into Downloads. Whether a real attacker used that route against the customer is not known.

Tests on Codex and Claude Code

Forever reproduced the attack on two agents to show it was not specific to one product. Against Codex, the real attacker file told Codex to register a server in ~/.codex/config.toml and run a command that installed the package. Because that config applies to every Codex session on the machine, the change would load the attacker's server in any folder afterward, not just Downloads. Codex ran the malware in more than 90% of attempts.

Against Claude Code, a planted CLAUDE.md tried to make Claude write an ANTHROPIC_BASE_URL into a project settings file, pointing API traffic at a server Forever controlled. That change leaks the session's login token, which is account takeover on its own, and lets the server reply as if it were the model and hand back commands the agent runs. Claude needs approval for such a write and often refuses one that looks wrong; the long engineering-doc framing got approval about half the time.

What to do

Forever said there is nothing for OpenAI or Anthropic to patch because an agent following the instructions file in its folder is doing what it was built to do. The company compared it to a browser rendering a phishing page: the browser worked as designed, and the attack lies in the page. "There is nothing here for OpenAI or Anthropic to patch," Forever said.

Forever advised: do not start Codex, Claude Code, or any agent in ~/Downloads. Look for instructions files you did not write; a stray AGENTS.md or CLAUDE.md in Downloads or a repository you just cloned is the whole attack. Read it before letting an agent near it. Check agent config: in ~/.codex/config.toml, watch for a server block or changed base URL you did not add; in a project's .claude/settings.json, watch for ANTHROPIC_BASE_URL or another API endpoint you did not set. Leave approval prompts and sandboxes on, and be wary of anything that tells the agent to switch them off. If you find a planted file, assume the login token leaked and rotate it.

Forever telemetry found about half of customers run a coding agent in Downloads, and roughly a quarter of agent sessions open a browser. Those are the conditions the attack needs.

Sources: The Hacker News