Overview
Security firm Forever Security reported catching a malicious AGENTS.md instruction file in the Downloads folder of a real customer's machine. The file was written to look like ordinary engineering notes, but it instructed an AI coding agent to register a server in its own configuration and install a known-malicious npm package. The agent was stopped before any code ran.
Researchers could not determine how the file arrived in the folder.
What the File Did
- The captured sample targeted OpenAI's Codex
- It directed the agent to install the npm package
function-color, which pulls in afunction-flagdownloader - The downloader fetches and runs a Windows payload
- The package belongs to the MALFEX malware campaign, previously analyzed by CloudSEK and Checkmarx
Reproduction on Claude Code
Forever also reproduced the technique against Anthropic's Claude Code using a planted CLAUDE.md. That variant tried to redirect API traffic to an attacker-controlled server, which could expose the user's login token. Per the report, it worked about half the time, versus more than 90% of attempts against Codex.
Why It Works
Coding agents trust instruction files in the folder where they are launched. A web page can also silently save a file into Downloads without prompting the user, and Forever built a proof-of-concept page demonstrating that delivery route. Forever argues there is nothing for OpenAI or Anthropic to patch, because the agent behaved as designed.
Mitigations
- Do not start coding agents in
~/Downloadsor other folders that receive untrusted files - Read any
AGENTS.mdorCLAUDE.mdyou did not write before an agent uses it - Check
~/.codex/config.tomland.claude/settings.jsonfor unexpected servers or changed base URLs - Keep approval prompts and sandboxing enabled
- If a planted file is found, assume the login token leaked and rotate it
Takeaway
Agent instruction files are now an attack surface equivalent to a shell profile or a CI config. Treat them as executable input and restrict where agents are allowed to run.