Planted file in Downloads tricked AI coding agent into installing malware

The latest:

A plain-text instructions file planted in a developer’s Downloads folder tried to steer their AI coding agent into installing a known-malicious npm package, security firm Forever Security said in a report published last week. The company said it caught the attempt on a real customer’s machine and stopped the agent before any code executed. It could not determine how the file reached the folder.

Details:

• The file: According to Forever, the planted file was AGENTS.md, the instructions document a coding agent such as OpenAI’s Codex reads on startup in a folder and follows as directions. It was written to look like ordinary engineering notes, with one section telling the agent to register a server in its own configuration and install an npm package named function-color.
• The payload: Forever said function-color belongs to a malware campaign documented separately by other researchers. The package pulls in a downloader called function-flag, which fetches and runs a Windows payload. Researchers at CloudSEK and Checkmarx, who analyzed the campaign, named it MALFEX.
• The mechanism: Two behaviors combine, Forever said. An agent is built to trust and obey the instructions file in the folder it opens, and a web page can save a file to the Downloads folder on its own, with no click and no permission prompt, choosing both the name and the contents. Together, a page can drop orders into a trusted folder.
• The unproven link: Researchers did not establish that this delivery route is how the customer’s file arrived. To show the full path was possible, Forever built a proof-of-concept page that silently downloads an AGENTS.md into Downloads on visit. Whether a real attacker used that route is not known.
• The Codex test: Forever reproduced the attack on two agents to show it was not tied to one product. Against Codex, it ran the real attacker file inside an isolated virtual machine. Framed as routine project setup, the file told Codex to register a server in ~/.codex/config.toml and run a command installing the package. Forever said Codex ran the malware in more than 90% of attempts.
• The persistence: Because that configuration file applies to every Codex session on the machine, the change would load the attacker’s server in any folder afterward, not only Downloads.
• The Claude variant: Against Claude Code, the working attack differed and succeeded less often. A planted CLAUDE.md, framed as internal gateway setup, tried to make Claude write an ANTHROPIC_BASE_URL into a project settings file pointing API traffic at a server Forever controlled, leaking the session login token and letting that server reply as the model.
• The approval rate: Claude requires a person to approve such a write and often refuses one that looks wrong, researchers said. The long engineering-document framing got the write approved about half the time.
• The vendor position: Forever compared the case to a browser rendering a phishing page: the browser worked as designed and the attack lives in the page. “There is nothing here for OpenAI or Anthropic to patch,” the company said.
• The exposure: In its own telemetry, Forever said about half of its customers run a coding agent in their Downloads folder, and roughly a quarter of agent sessions open a browser. Its advice includes never starting an agent in ~/Downloads, reading stray instruction files, auditing agent configuration, keeping approval prompts on, and rotating any token assumed leaked.

Between the lines:

The two conditions Forever reported in its telemetry are what make the technique practical rather than theoretical: agents started in the one folder the web can write to unprompted, and sessions where the agent itself does the browsing. In that combination no person is watching when a file arrives, which is why the Codex path, altering a machine-wide config file, outlasts the single session it began in.

What’s next

Watch whether OpenAI or Anthropic respond to Forever’s conclusion that no patch applies, and whether CloudSEK or Checkmarx report further packages tied to the MALFEX downloader chain.