Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware

The file, named AGENTS.md, was a plain-text instructions file that an AI coding agent reads and follows when it starts in a folder. It was disguised as ordinary engineering notes and told the agent to add a server to its own configuration and install a package called function-color from npm.

Forever Security caught the attempt on a real customer's machine and stopped the agent before any code ran. The company could not determine how the file got into the folder, but it built a proof-of-concept web page that can silently download an AGENTS.md file into the Downloads folder without a click or permission prompt.

The function-color package is part of a malware campaign named MALFEX by researchers at CloudSEK and Checkmarx. That package pulls in a downloader called function-flag, which fetches and runs a Windows payload.

Attack reproduced on two agents

Researchers reproduced the attack on two coding agents to show it was not specific to a single product. Against OpenAI's Codex, they ran the attacker file inside an isolated virtual machine. The file, framed as routine project setup, told Codex to register a server in ~/.codex/config.toml and run a command that installed the package.

Because that config file applies to every Codex session on the machine, the change would load the attacker's server in any folder afterward, not just Downloads. Codex ran the malware in more than 90% of attempts.

Against Claude Code, the working attack looked different and succeeded less often. A planted CLAUDE.md, framed as internal gateway setup, tried to make Claude write an ANTHROPIC_BASE_URL into a project settings file, pointing its API traffic at a server Forever controlled.

That one change leaks the session's login token, which is account takeover on its own, and lets the server reply as if it were the model and hand back commands the agent runs. Claude needs a person to approve a write like that and often refuses one that looks wrong; the long engineering-doc framing got the write approved about half the time.

No patch needed, security firm says

There is nothing for OpenAI or Anthropic to patch, in Forever's view, because an agent following the instructions file in its folder is doing what it was built to do. The company compared it to a browser rendering a phishing page: the browser worked as designed, and the attack lies in the page.

Practical steps to avoid the threat

Forever's advice is practical and needs no product. Do not start Codex, Claude Code, or any agent in ~/Downloads, as it is the one folder the web can write to on its own. Look for instructions files you did not write. A stray AGENTS.md or CLAUDE.md, in Downloads or in a repository you just cloned, is the whole attack. Read it before you let an agent near it.

Check the agent's own config. In ~/.codex/config.toml, watch for a server block or a changed base URL you did not add. In a project's .claude/settings., watch for an ANTHROPIC_BASE_URL or other API endpoint you did not set.