Malicious instruction files target AI coding agents in Downloads
Malicious instruction file intercepted on customer device
Forever Security said it stopped a malicious AGENTS.md file on a real customer machine from directing an AI coding agent to install the known-malicious npm package function-color. The file was located in the developer’s Downloads folder and was presented as ordinary engineering documentation. No code ran because the company intercepted the attempt.
AGENTS.md is a plain-text instruction file that coding agents, including OpenAI Codex, can read when they start in a folder. The detected file told the agent to add a server to its configuration and install function-color. Researchers could not establish how the file reached the customer’s Downloads directory.
CloudSEK and Checkmarx have separately documented the malware campaign involving function-color under the name MALFEX. The package pulls in a downloader called function-flag, which fetches and runs a Windows payload.
Why Downloads becomes a trust boundary
Forever Security said the attack combines two expected behaviours. A coding agent is designed to follow instruction files found in the folder it opens, while a web page can save a file in Downloads without a click or permission prompt and can select that file’s name and contents.
The firm built a proof-of-concept page to test the route. Visiting it caused an AGENTS.md file to download silently into Downloads. That demonstration does not prove the same delivery method was used against the customer, but it shows how a file written by the web could be treated as instructions by an agent launched in that directory.
In an isolated virtual machine, Forever ran the attacker file against Codex. It instructed Codex to register a server in ~/.codex/config.toml and run the command that installed the package. Because this configuration applies to every Codex session on the machine, the change could load the attacker’s server in later sessions outside Downloads. Forever said Codex ran the malware in more than 90% of attempts.
Claude Code test exposed a different path
Forever also reproduced a related attack against Claude Code. A planted CLAUDE.md, framed as internal gateway setup, tried to write an ANTHROPIC_BASE_URL value into a project settings file. That value directed API traffic to a server controlled by Forever during the test.
The company said such a change can expose the session login token, enabling account takeover, and allows the server to respond as though it were the model and return commands for the agent to run. Claude Code requires a person to approve a write of this kind and often rejects a suspicious request, but the longer engineering-document framing obtained approval in about half of the researchers’ tests.
Forever’s position is that the issue is not a product defect to patch: the agents are following local instructions as designed. Its telemetry found that about half of its customers run a coding agent in Downloads, while roughly a quarter of agent sessions open a browser.
Operational steps for teams using coding agents
Teams should avoid launching Codex, Claude Code, or similar agents in ~/Downloads; inspect unfamiliar AGENTS.md and CLAUDE.md files before an agent opens a directory; and review ~/.codex/config.toml for unrecognised server blocks or changed base URLs. Project-level .claude/settings.json files should also be checked for an ANTHROPIC_BASE_URL or another endpoint that was not configured by the team.
Approval prompts and sandboxes should remain enabled, particularly when instructions request that they be disabled. If a planted instruction file is found, Forever advises treating the login token as exposed and rotating it, because a stolen token represents a live session. The practical implication is to treat agent instruction files and the Downloads folder as security-sensitive inputs before starting an AI coding workflow.