Poisoned Instruction File in Downloads Folder Nearly Tricked an AI Coding Agent Into Installing Malware
A malicious AGENTS.md file found on a real developer's machine last week came within a whisker of getting an AI coding agent to install a known-bad npm package. Security firm Forever Security caught it, killed the agent session before anything ran, and published their analysis. They never figured out how the file got there.
If you haven't encountered them before, AGENTS.md files are plain-text instruction sets that coding agents like OpenAI's Codex read on startup when opened in a directory. The agent treats them as orders. This one was dressed up to look like ordinary project notes, but buried in the engineering boilerplate was an instruction to register a remote server in the agent's config and install an npm package called function-color.
That package is not obscure in security circles. CloudSEK and Checkmarx have both documented the campaign around it, which they dubbed MALFEX. function-color pulls down a secondary package called function-flag, which fetches and executes a Windows payload. It's a standard multi-stage dropper, and someone tried to get a developer's AI assistant to install it automatically.
The mechanism that makes this work is two mundane things colliding badly. First, coding agents are designed to trust and follow instruction files in whatever directory they open. Second, a web page can silently write a file to a user's Downloads folder without any click or permission prompt, with full control over the filename and contents. Neither of those facts is alarming on its own. Together, they let a website drop a file that an agent will treat as authoritative instructions into a folder the agent then opens.
Forever Security didn't confirm that a browser drop was how the attacker's file landed on the customer's machine. But they built a proof-of-concept to show it was viable: visit a specific page, and an AGENTS.md silently appears in Downloads. Whether that's what actually happened remains unknown.
They then tested the attack against two different agents to establish this isn't a single-product problem.
Against Codex, they ran the original attacker file inside an isolated VM. Framed as routine project setup, it instructed Codex to add a server entry to ~/.codex/config.toml and then install the malicious package. The config change is the nasty part: because that file governs every Codex session on the machine, the attacker's server gets loaded in every subsequent session regardless of which project you're working in. Codex complied in over 90% of test runs.
Claude Code proved harder to crack, though not immune. A planted CLAUDE.md, styled as internal gateway documentation, attempted to get Claude to write an ANTHROPIC_BASE_URL into a project settings file, redirecting its API traffic to a server Forever controlled. That's enough to steal the session token and hand the attacker full model impersonation, meaning they could respond to the agent as if they were Claude and issue whatever commands they liked. Claude requires explicit user approval for writes and frequently refuses ones that look off. With enough engineering-doc framing to provide plausible cover, it approved the write roughly half the time.
Forever's conclusion is that there's nothing here for OpenAI or Anthropic to patch. An agent following the instruction file in its working directory is behaving exactly as designed. The comparison they draw is a browser rendering a phishing page: the browser isn't broken, the attack is in the content. That framing is honest, if slightly convenient for the vendors.
What you should actually do
Don't run Codex, Claude Code, or any other agent with Downloads as its working directory. It's the one folder the web can write to silently, which makes it the obvious staging ground for this kind of attack.
If you find an AGENTS.md or CLAUDE.md that you didn't put there, whether in Downloads or in a freshly cloned repository, read it before you let an agent anywhere near it. The entire attack surface is that file.
Check your agent's config files. In ~/.codex/config.toml, look for any server block you didn't add. In a project's .claude/settings.json, look for an ANTHROPIC_BASE_URL or unfamiliar API endpoint. Either is a red flag.
Leave approval prompts and sandbox settings enabled. Be suspicious of any instruction that asks you to turn them off.
If you find a planted file, treat your session token as compromised and rotate it immediately. A stolen token is a live session, not a historical record.
Forever's own telemetry adds some context to how widespread the exposure is: around half of their customers run a coding agent in their Downloads folder, and roughly a quarter of agent sessions involve the agent opening a browser. That second point matters more than it sounds. If the agent is doing the browsing, no human is watching when a file arrives.