- Published on
Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware
- Authors
- Name
- DeepHorus
Forever Security reported last week that a malicious AGENTS.md file sitting in a developer’s Downloads folder tried to instruct an AI coding agent to install a known-malicious npm package. The firm caught the attempt on a real customer’s machine and stopped the agent before any code ran. It could not determine how the file got into the Downloads folder.
The file was AGENTS.md, a plain-text instructions file that coding agents such as OpenAI’s Codex read when they start in a folder and then follow as directions. It was dressed up as ordinary engineering notes. One section told the agent to add a server to its own configuration and install a package called function-color from npm.
That package is part of a malware campaign documented separately by other researchers. According to CloudSEK and Checkmarx, function-color pulls in a downloader called function-flag, which fetches and runs a Windows payload; the researchers named the campaign MALFEX. Forever said two things, each harmless alone, make the attack work: an agent is built to trust the instructions file in the folder it opens, and a web page can save a file to Downloads without a click or permission prompt, choosing the name and contents.
Researchers did not establish that this was how the customer’s file arrived. To test whether the full path was possible, Forever built a proof-of-concept page that silently downloads an AGENTS.md into Downloads when visited. Whether a real attacker used that route against the customer is unknown. The firm then reproduced the attack on two coding agents to show it was not specific to one product.
Against Codex, Forever ran the real attacker file inside an isolated virtual machine. The file, framed as routine project setup, told Codex to register a server in ~/.codex/config.toml and run a command that installed the package. Because that config applies to every Codex session on the machine, the change would load the attacker’s server in any folder afterward, not just Downloads. Codex ran the malware in more than 90% of attempts, Forever said.
Against Claude Code, the working attack looked different and succeeded less often. A planted CLAUDE.md, framed as internal gateway setup, tried to make Claude write an ANTHROPIC_BASE_URL into a project settings file, pointing its API traffic at a server Forever controlled. That change leaks the session’s login token, which is account takeover on its own, and lets the server reply as if it were the model and hand back commands the agent runs. Claude requires a person to approve such a write and often refuses one that looks wrong; the long engineering-document framing got the write approved about half the time, researchers said.
In Forever’s view, there is nothing for OpenAI or Anthropic to patch, because an agent following the instructions file in its folder is doing what it was built to do. The company compared it to a browser rendering a phishing page: the browser worked as designed, and the attack lies in the page. Forever’s advice is practical: do not start Codex, Claude Code, or any agent in ~/Downloads, inspect stray AGENTS.md or CLAUDE.md files, check agent configuration for added servers or altered API endpoints, keep approval prompts and sandboxes on, and assume the login token leaked if a planted file is found.
