A file silently saved into a developer’s Downloads folder by a web page can be enough to turn an artificial intelligence (AI) coding agent against its user, security firm Forever Security reported on October 22. The company said it stopped a coding agent on a customer’s machine from installing a known-malicious npm package after the agent followed instructions from an AGENTS.md file the customer did not know was there.

In a blog post, researchers Gal Weizman and Omer Samet said they traced the instruction to a file in the customer’s Downloads folder. Coding agents such as OpenAI’s Codex and Anthropic’s Claude Code read instruction files, AGENTS.md and CLAUDE.md, from the folder they are opened in. According to the researchers, a web page can drop a file into Downloads “with no click and no permission,” and an agent opened in that folder will then read the file and follow it as if it were trusted project configuration.

What the testing found

Forever said it tested the technique against both agents in controlled conditions, with the agent launched in the folder containing the planted file. “In our testing, Codex ran the malware in more than 90% of attempts,” the researchers wrote, running the real malicious package inside an isolated virtual machine. They said several Codex controls, including a trust gate and the network sandbox, had to be worked around, and that the planted file led the agent to change its machine-wide configuration, so the effect carried over to every session on that machine.

For Claude Code, the researchers said a planted CLAUDE.md could lead the agent to redirect its API traffic to a server controlled by an attacker, which they said could leak the user’s OAuth token, allowing account takeover, and enable code execution. “In our testing, Claude followed through on this about 50% of the time,” they wrote, with same-session code execution succeeding roughly one time in five. Most of the Claude Code testing used a harmless stand-in, and the real package was run once in an isolated virtual machine.

The firm also cited its own customer telemetry: “about half of customers run a coding agent inside their Downloads folder,” and “roughly a quarter of agent sessions open a real browser.” It noted that agents which browse the web on their own could fetch such a file without a human ever seeing it.

The package behind it

The package the agent tried to install, function-color, belongs to a campaign that Checkmarx researchers documented on October 5 under the name MALFEX. According to Checkmarx Zero, a single adversary has been publishing to the npm registry since August 2023 and has released 12 packages, eight of them malicious, with payloads that target Windows only. Function-color carries no payload itself; it acts as a wrapper that installs a second package, function-flag, which downloads an external executable after installation. Checkmarx said it could not retrieve the final payload for that path during its investigation.

Checkmarx counted 40,767 recorded downloads across the campaign, 37,419 of them for function-flag, and stressed that the figures show registry reach rather than confirmed infections. At the time of its write-up, function-flag and function-color had no malware advisories, meaning tools that rely only on advisory feeds would miss them, and three malicious packages were still installable. Forever said npm has since removed function-color.

Why it matters

The researchers argued that neither agent is broken. “There is nothing here for OpenAI or Anthropic to patch,” they wrote, describing the risk as a consequence of how the tools are designed to work: an agent that takes instructions from files in its working directory will also take them from files it did not expect. That places the burden on developers and security teams to control where agents are launched and which instruction files they are allowed to trust.

The incident also shows how prompt injection and ordinary supply-chain malware can combine. In the case Forever described, the planted text did not rely on a software flaw; it needed only an agent with permission to install packages and a malicious package already available on a public registry.

What developers can do

  • Do not start AI coding agents in the Downloads folder.
  • Review any AGENTS.md or CLAUDE.md file you did not write before letting an agent read it.
  • Check agent configuration files for unexpected server entries or changed API endpoints.
  • Keep approval prompts and sandboxes enabled, and be wary of any instruction that tells an agent to bypass them.
  • Treat an installation of function-color as a sign of compromise and rotate credentials; the researchers advise users to “assume the token leaked.”
  • Block the MALFEX packages, including the wrapper packages, at the registry proxy and check lockfiles and transitive dependencies, as Checkmarx recommends, rather than relying on advisory feeds alone.

The caveats

The success rates and telemetry figures come solely from Forever Security’s own testing and customer data. Forever is a security vendor whose product detected the incident on a customer machine. Its post does not say whether the findings were disclosed to OpenAI or Anthropic, and it reports no response from either company.

Corrections and tips: email the editor using the address on the Contact page.