A plain text file placed in the Downloads folder can trick AI coding agents into changing their settings, installing malware, or exposing login tokens.
Forever Security discovered the risk after stopping an agent on a real customer’s computer from installing a known malicious npm package. The company later reproduced separate attack paths against OpenAI Codex and Anthropic Claude Code in controlled tests.
The incident began when Forever Security blocked an AI coding agent from installing a package named function-color. Investigators traced the order back to an AGENTS.md file stored in the customer’s ~/Downloads folder.
The file looked like a normal set of engineering notes, but it contained carefully written instructions telling the agent to change its own setup and install the package.
The source of the file remains unknown. Researchers did not prove that a malicious website placed it on the customer’s machine. Instead, they later showed that a website could deliver a file with the same name through normal browser download behavior, creating a possible path for the attack.
An AGENTS.md file is similar to a README written for AI tools. OpenAI’s documentation says Codex reads these files before starting work and uses them to learn project rules, commands, and other instructions. Claude Code uses CLAUDE.md for a similar purpose and reads it at the start of a conversation.
The danger comes from combining trusted agent instructions with a folder where web downloads normally arrive. A Markdown file cannot run by itself, so operating system checks designed for downloaded programs may not treat it as dangerous. The risk appears when an AI agent reads the text as trusted instructions and uses its own tools to carry them out.
The attack is not fully automatic. The victim must run the coding agent from Downloads or otherwise allow it to process the planted instruction file. The agent must also have enough access to edit files, run commands, connect to the internet, or install packages. Approval prompts and sandbox controls can therefore reduce the chance of success.
Codex Attack Creates Persistence
In Forever Security’s controlled tests, Codex followed the malicious file in more than 90% of attempts. The instructions persuaded Codex to add an MCP server entry to ~/.codex/config.toml, its machine-wide configuration file, and start a second Codex session with approval and sandbox checks disabled.
This change made the attack persistent. Once the rogue server was written into the global configuration, later Codex sessions could load it even when the user moved to another folder or project. Most tests used a harmless program, while the real malicious package was run once inside an isolated virtual machine.
The package belonged to MALFEX, a long-running npm malware campaign targeting Windows developers. Checkmarx found that function-color pulled in function-flag, which could download and quietly run a Windows program.
The wider campaign also used packages able to deliver remote-access malware and steal browser, Discord, Telegram, and cryptocurrency wallet data. More technical details are available in Cyber Security News’ report on the MALFEX npm malware campaign.
Claude Code Exposed Tokens
Claude Code required a different method. Researchers created a malicious CLAUDE.md that asked Claude to write an ANTHROPIC_BASE_URL value into .claude/settings.json. This redirected Claude’s API traffic to a server controlled by the researchers and exposed the OAuth token carried with the requests.
Forever reported that Claude made the change in about half of its tests. The team replayed a captured token against Anthropic’s service and gained access as the victim. In some tests, the fake server also returned tool commands that led to code execution. Same-session execution through a helper agent worked about one-fifth of the time.
The research adds to growing evidence that instruction files and add-ons can become a software supply-chain risk. Earlier research found that malicious agent skills targeting Claude Code and Codex could hide harmful actions from automated scanners.
Developers should never start Codex, Claude Code, or another coding agent inside Downloads. Unknown AGENTS.md and CLAUDE.md files should be reviewed before an agent opens the folder. Users should also keep approval checks and sandboxes enabled, limit agent network access, and avoid instructions that request unsafe bypass options.
Security teams should inspect ~/.codex/config.toml for unknown MCP servers and review .claude/settings.json for an unfamiliar ANTHROPIC_BASE_URL or proxy.
Finding function-color, unexpected agent settings, or redirected API traffic should be treated as a possible compromise. Affected tokens and connected credentials should be revoked from a clean device, while the system should be isolated and checked for malware.
Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.
