A malicious instruction file sitting in a developer’s Downloads folder tried to make their AI coding agent install a known-malicious npm package, security firm Forever Security said in a report published last week.
The company caught the attempt on a real customer’s machine and stopped the agent before any code ran. It could not determine how the file got into the folder.
The file was AGENTS.md, a plain-text instructions file that a coding agent, such as OpenAI’s Codex, reads when it starts in a folder and follows as directions.
It was dressed up as ordinary engineering notes. One section told the agent to add a server to its own configuration and install a package called function-color from npm.
That package is part of a malware campaign that other researchers have documented separately: function-color pulls in a downloader called function-flag, which fetches and runs a Windows payload. Researchers at CloudSEK and Checkmarx, who analyzed the campaign, named it MALFEX.
Two things, each harmless on its own, make this work, Forever said. An agent is built to trust and obey the instructions file in the folder it opens. And a web page can save a file to the Downloads folder on its own, without a click or a permission prompt, choosing the name and contents. Put together, a web page can drop a file the agent will treat as orders into a folder the agent trusts.
Researchers did not establish that this is how the file was caught. To test whether the full path was possible, it built its own proof-of-concept page: visit it, and an AGENTS.md downloads silently into Downloads. Whether a real attacker used that route against the customer is not known.
The firm then reproduced the attack on two coding agents to show that it was not specific to a single product. Against Codex, it ran the real attacker file inside an isolated virtual machine. The file, framed as routine project setup, told Codex to register a server in ~/.codex/config.toml and run a command that installed the package.
Because that config file applies to every Codex session on the machine, the change would load the attacker’s server in any folder afterward, not just Downloads. Codex ran the malware in more than 90% of attempts, Forever said.
Against Claude Code, the working attack looked different and succeeded less often. A planted CLAUDE.md, framed as internal gateway setup, tried to make Claude write an ANTHROPIC_BASE_URL into a project settings file, pointing its API traffic at a server Forever controlled. That one change leaks the session’s login token, which is account takeover on its own, and lets the server reply as if it were the model and hand back commands the agent runs.
Claude needs a person to approve a write like that and often refuses one that looks wrong; the long engineering-doc framing got the write approved about half the time, researchers said.
There is nothing for OpenAI or Anthropic to patch, in Forever’s view, because an agent following the instructions file in its folder is doing what it was built to do. The company compared it to a browser rendering a phishing page: the browser worked as designed, and the attack lies in the page. “There is nothing here for OpenAI or Anthropic to patch,” Forever said.
What to do
Forever’s advice is practical and needs no product:
- Do not start Codex, Claude Code, or any agent in ~/Downloads. It is the one folder the web can write to on its own.
- Look for instructions files you did not write. A stray AGENTS.md or CLAUDE.md, in Downloads or in a repository you just cloned, is the whole attack. Read it before you let an agent near it.
- Check the agent’s own config. In ~/.codex/config.toml, watch for a server block or a changed base URL you did not add. In a project’s .claude/settings.json, watch for an ANTHROPIC_BASE_URL or other API endpoint you did not set.
- Leave approval prompts and sandboxes on, and be wary of anything that tells the agent to switch them off.
- If you find a planted file, assume the login token leaked and rotate it. A stolen token is a live session, not just one caught request.
In its own telemetry, Forever said that about half of its customers run a coding agent in their Downloads folder, and roughly a quarter of agent sessions open a browser.
Those are the conditions the attack needs: an agent starts where the web can write, and, in many cases, an agent does the browsing itself, so no person is watching when a file arrives.
