A plain-text instruction file sitting in a developer's Downloads folder was enough to push an AI coding agent toward installing malware. Security firm Forever Security says it caught the attempt on a real customer's computer and then showed that the same trick can steer both OpenAI Codex and Claude Code into running attacker code or leaking login tokens.
What happened
Forever Security, a company that monitors the risks created by AI agents, says its tooling stopped a coding agent mid-session as it tried to install an npm package called function-color. The instruction did not come from a dependency or a cloned repository. It came from an AGENTS.md file in the customer's ~/Downloads folder, which the agent was using as its working directory.
Files like AGENTS.md and CLAUDE.md are meant to give coding agents project notes, such as which tools to use, how to run tests and which coding style to follow. Agents load them automatically from the folder they start in and treat the contents as directions. The planted file was written to look like a long, ordinary set of engineering guidelines, with one section near the end framed as routine setup.
The researchers could not work out how the file reached the customer's machine. To show one possible route, they built a proof-of-concept web page that drops an AGENTS.md into Downloads as soon as someone visits. BleepingComputer tested that page and received a file with harmless placeholder text. Chrome, Edge and Firefox save downloads to that folder by default without asking where to put them, though they do show a download notification, while Brave asked for approval in BleepingComputer's test.
Who is affected
Anyone who launches an AI coding agent from a folder that can receive files from the web is exposed, and the Downloads folder is the most obvious one. Forever researcher Gal Weizman told BleepingComputer that hundreds of the company's customers run agents such as Claude Code, OpenAI Codex and Cursor CLI from Downloads, often to tidy it up or work on a file they just grabbed. Claude Code alone started more than 1,300 sessions from that location, according to the firm.
No CVE has been assigned. Forever argues there is nothing for OpenAI or Anthropic to patch, because an agent that obeys the instruction file in its folder is doing what it was designed to do.
Technical details
- Codex: the captured file told Codex to add a "project tools" server entry to
~/.codex/config.tomlthat installsfunction-colorfrom npm. Because that is Codex's machine-wide configuration, the entry would load in every later Codex session, in any folder. Forever says Codex followed the instructions in more than 90% of its test runs, most of which used a harmless stand-in payload that only opened a calculator. - The payload: according to The Hacker News,
function-colorbelongs to a malware campaign that CloudSEK and Checkmarx researchers named MALFEX. The package pulls in a downloader calledfunction-flag, which fetches and runs a Windows payload. - Claude Code: the researchers wrote their own
CLAUDE.md, inspired by the captured file, asking Claude Code to setANTHROPIC_BASE_URLin a project.claude/settings.jsonto a server they controlled. That sends the agent's API traffic, including its OAuth token, to the attacker, who can then pose as the model and hand back commands. Claude Code asks a person to approve that kind of change and often refused, but the attack worked in roughly half of the tests.
What you should do
- Don't start a coding agent in Downloads or in your home folder. OpenAI and Anthropic both recommend launching agents from the root of the specific project they should work on.
- Read instruction files you didn't write. Check any unfamiliar
AGENTS.md,CLAUDE.mdor similar file, whether it showed up in Downloads or in a repository you just cloned. - Inspect agent settings. Look in
~/.codex/config.tomlfor server entries you didn't add, and in project.claude/settings.jsonfiles for an API address you didn't set. - Keep approval prompts and sandboxing on, and be suspicious of any instructions that ask the agent to turn them off.
- Rotate tokens if you find a planted file, and test untrusted code in an isolated environment before running it on your main machine.
Sources
- BleepingComputer: AI coding agents hijacked using AGENTS.md file in Downloads folder
- Forever Security: Hijacking AI agents via the Downloads folder
- The Hacker News: Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware
- Help Net Security: AI coding agents fall for malicious instructions planted in the Downloads folder
0 Comments