Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware

A malicious AGENTS.md file sitting in the Downloads folder of a real customer's machine tried to make that developer's AI coding agent install a known-malicious npm package, security firm Forever Security said in a report covered by The Hacker News on October 26. The company caught the attempt in progress and stopped the agent before any code ran, but it could not determine how the file got into the folder.

The file was AGENTS.md, the plain-text instructions file that a coding agent such as OpenAI's Codex reads when it starts in a folder and then follows as directions. It was dressed up as ordinary engineering notes, and one section told the agent to add a server to its own configuration and install a package called function-color from npm.

That package is part of a malware campaign other researchers have already documented: function-color pulls in a downloader named function-flag, which fetches and runs a Windows payload. CloudSEK and Checkmarx, which analyzed the campaign, named it MALFEX.

Forever argues the technique works by combining two things that are harmless on their own. An agent is built to trust and obey the instructions file in the folder it opens, and a web page can save a file to the Downloads folder by itself, with no click and no permission prompt, choosing both the name and the contents. Put together, a page can drop a file the agent will treat as orders into a folder the agent trusts. The researchers did not establish that this was the route used against the customer, but they built a proof-of-concept page that silently downloads an AGENTS.md into Downloads on visit.

The firm then reproduced the attack on both Codex and Claude Code to show it is not specific to a single product. Against Codex it ran the real attacker file inside an isolated virtual machine; framed as routine project setup, the file told Codex to register a server in ~/.codex/config.toml and run a command that installed the package. Because that config file applies to every Codex session on the machine, the change would load the attacker's server in any folder afterward, and Forever said Codex ran the malware in more than 90% of attempts.

Against Claude Code the working attack looked different and succeeded less often. A planted CLAUDE.md, framed as internal gateway setup, tried to make Claude write an ANTHROPIC_BASE_URL into a project settings file, pointing its API traffic at a server Forever controlled. That single change leaks the session's login token, which is account takeover on its own, and lets the server reply as if it were the model and hand back commands the agent runs. Claude needs a person to approve a write like that and often refuses one that looks wrong; the long engineering-document framing got the write approved about half the time.

There is nothing for OpenAI or Anthropic to patch, in Forever's view, because an agent following the instructions file in its folder is doing what it was built to do. The company compared it to a browser rendering a phishing page: the browser worked as designed, and the attack lies in the page.

Forever's advice needs no product: do not start Codex, Claude Code, or any agent in ~/Downloads, the one folder the web can write to on its own; look for instructions files you did not write, since a stray AGENTS.md or CLAUDE.md is the whole attack; check ~/.codex/config.toml for a server block or changed base URL you did not add, and a project's .claude/settings.json for an ANTHROPIC_BASE_URL you did not set; leave approval prompts and sandboxes on; and if you find a planted file, assume the login token leaked and rotate it.

Forever's own telemetry sharpens the risk: about half of its customers run a coding agent in their Downloads folder, and roughly a quarter of agent sessions open a browser. Those are exactly the conditions the attack needs — an agent starting where the web can write, and in many cases an agent doing the browsing itself, so no person is watching when the file arrives.