Malicious Downloads file tricks AI coding agents into installing malware

A security firm Forever Security has described a staged attempt to weaponise an ordinary-looking text file placed in a developer’s Downloads folder to direct an AI coding agent to install a malicious npm package. The file, named AGENTS[.]md, was designed as routine engineering notes and purported to instruct the agent to register a server and install a package called function-color from npm.

Function-color is part of a broader malware campaign that researchers have linked to the MALFEX family, which uses function-color to pull in a downloader called function-flag, ultimately delivering a Windows payload. Forever Security reported observing the attempt on a real customer’s machine and stopping the agent before any code executed; the researchers could not determine how the file ended up in Downloads.

The researchers demonstrated that the attack relies on two factors working in concert: an agent’s built-in trust in instructions found in its folder, and a web page’s ability to silently write files to the Downloads folder with arbitrary names. In tests, Codex consistently executed the malicious commands when the AGENTS[.]md file appeared, changing the user’s Codex configuration to load an attacker-controlled server in ~/.codex/config[.]toml and enabling the package installation.

A Claude Code test succeeded less often, with a planted CLAUDE[.]md attempting to modify ANTHROPIC_BASE_URL settings and potentially leaking a login token. OpenAI and Anthropic have reportedly no patch to apply, as the agent is behaving as designed when following the instruction file. Forever recommended practical mitigations, including avoiding starting agents in Downloads, checking for stray instruction files, and verifying agent configurations and prompts.