A malicious instruction file found in a developer’s Downloads folder attempted to steer an AI coding agent into installing malware, exposing a security risk created when autonomous development tools trust local configuration files.
Researchers at Forever Security said they detected the activity on a customer’s machine and stopped the agent before malicious code executed. The source of the file remains unknown, meaning researchers have not established how it reached the affected computer.
The file was named AGENTS.md, a plain-text document used to give AI coding agents persistent project instructions. OpenAI documentation confirms that Codex recognizes AGENTS.md files as repository guidance.
In the incident, the file was disguised as ordinary engineering documentation but contained instructions intended to alter the agent’s configuration and install function-color, an npm package previously identified as malicious.
The technique is notable because the Markdown file itself contained no conventional executable malware. Instead, it attempted to persuade an AI agent to carry out the harmful actions.
Researchers reproduce attack against Codex
Forever Security reproduced the technique against OpenAI Codex in an isolated virtual machine using the malicious AGENTS.md file recovered from the customer system.
The instructions directed Codex to add an attacker-controlled MCP server configuration to ~/.codex/config.toml, install the malicious npm package and launch another Codex process with approval and sandbox protections disabled. Codex completed the malicious execution chain in more than 90% of the researchers’ tests, Forever Security said. Because the configuration change was written to machine-level settings rather than a single project, it could also affect later Codex sessions.
The researchers described the technique as an abuse of an agent’s normal instruction-following behavior rather than a traditional software vulnerability. OpenAI provides sandboxing and approval controls around command execution, and the malicious instructions specifically attempted to weaken or bypass those protections.
Claude Code test exposed an authentication token
Forever Security also developed a separate proof of concept against Anthropic’s Claude Code using a malicious CLAUDE.md file.
Instead of installing malware directly, the file attempted to make Claude Code change its API configuration by setting ANTHROPIC_BASE_URL to infrastructure controlled by the researchers. Anthropic supports ANTHROPIC_BASE_URL as a configuration option for routing Claude Code traffic through alternative API gateways.
The test caused Claude Code to send an OAuth credential to the controlled server. In a real attack, that could potentially allow an attacker to impersonate the expected API service and return further instructions to the agent. The technique succeeded in around half of the researchers’ tests. Claude Code required more user interaction than Codex, including approval for configuration changes, making the attack more dependent on convincing the operator that the requested actions were legitimate.
Downloads folder creates an unusual trust problem
The potential attack path combines routine browser downloading with the way AI agents search for local instruction files.
A website can cause a file to be saved into a user’s Downloads directory under common browser configurations. BleepingComputer independently tested the researchers’ proof of concept and found that Chrome, Edge and Firefox could save the AGENTS.md file automatically while displaying a download notification. Brave prompted for approval during testing.
Simply downloading the file would not compromise a computer. A user would also need to launch a compatible AI coding agent from a location where the planted instructions could be treated as trusted context.
Forever Security said its telemetry showed that customers had launched agents including Codex, Claude Code and Cursor CLI from Downloads. Researcher Gal Weizman told BleepingComputer that Claude Code had been started from that directory in more than 1,300 observed sessions.
Those figures reflect Forever Security’s customer data and do not indicate broader industry usage.
Malicious package linked to MALFEX campaign
The function-color package named in the recovered instructions had previously been tied to a wider npm malware campaign known as MALFEX, where Checkmarx researchers identified eight malicious packages and found that function-color depended on another malicious package, function-flag, which used an installation script to download and execute additional Windows payloads.
Forever Security has not established that a malicious website planted the file found on the customer’s computer, only that its browser demonstration showed such a delivery route was possible
Its browser demonstration showed that such a delivery route is possible, but has not established a malicious website or source in a observed incident.
The incident shows a growing security challenge as AI development agents gain permission to edit files, change configuration and execute commands.
The researchers recommend avoiding launching coding agents directly from Downloads, reviewing unfamiliar AGENTS.md and CLAUDE.md files, keeping sandbox and approval protections enabled, and checking agent configuration for unexpected changes.
Leave a Reply