Category: Security | Reading time: 3 min
Security firm Forever Security reports that a malicious instruction file sitting in a developer's Downloads folder tried to make the developer's AI coding agent install a known-malicious npm package. Forever caught the attempt on a real customer's machine and stopped the agent before any code ran. It could not determine how the file got there.
The attack
The file was AGENTS.md, the plain-text instructions file a coding agent such as OpenAI's Codex reads and follows when it starts in a folder. Dressed up as engineering notes, it told the agent to add a server to its own configuration and install a package called function-color. That package is part of a malware campaign CloudSEK and Checkmarx have named MALFEX: it pulls in a downloader, function-flag, which fetches and runs a Windows payload.
Forever's point is that two ordinary behaviors combine. An agent trusts the instructions file in its folder, and a web page can save a file to Downloads without a click or permission prompt. Forever built a proof-of-concept page that does exactly that, though it does not know whether a real attacker used that route.
Reproduced on two agents
Against Codex, the real attacker file told the agent to register a server in ~/.codex/config.toml, which applies to every Codex session on the machine. Codex ran the malware in more than 90% of attempts. Against Claude Code, a planted CLAUDE.md tried to point API traffic at a Forever-controlled server, which leaks the session's login token. Claude requires human approval for that write and often refuses; the framing got it approved about half the time.
Forever argues there is nothing for OpenAI or Anthropic to patch, since the agents behaved as designed. In its telemetry, about half of its customers run a coding agent in their Downloads folder, and roughly a quarter of agent sessions open a browser.
Why it matters
The instruction came from a file, not a person, and the agent could not tell the difference. Security teams need to know which instructions an agent acted on, which identity and permissions it used, and a record of each configuration change it made, so a planted directive is caught before it persists across every session.
Source: The Hacker News | BleepingComputer