Forever Security says a booby-trapped instructions file in a Downloads folder tried to make a coding agent install a malicious npm package.
A plain-text file in a developer's Downloads folder tried to get the developer's AI coding agent to install a known-malicious software package, according to security firm Forever Security. In a report published last week, the company said it detected the attempt on a real customer's machine and stopped the agent before any malicious code ran. Forever then reproduced the technique against two popular coding agents, OpenAI's Codex and Anthropic's Claude Code. It argues that the underlying weakness is not something either vendor can fix with a patch.
The file was called AGENTS.md. AI coding agents use files with this name as a set of standing instructions. When an agent such as Codex starts working in a folder, it reads the file and treats what it says as directions to follow.
The planted file looked like ordinary engineering notes. One section told the agent to add a new server to its own configuration and to install a package called function-color from npm, the public registry where JavaScript developers publish and download code libraries.
That package is not new to researchers. CloudSEK and Checkmarx have separately documented it as part of a malware campaign they named MALFEX. In that campaign, function-color brings in a second package, function-flag. The second package acts as a downloader: it fetches a Windows payload and runs it.
Forever said it could not work out how the file reached the customer's Downloads folder. To see whether a website could have put it there, the firm built its own proof-of-concept web page. Visiting the page caused an AGENTS.md file to land in Downloads without any visible prompt. Forever was clear that this only shows the route is possible. It does not show that a real attacker used it against the customer.
The company then tested the attack against two coding agents. It wanted to show the problem was not limited to one product.
The report names two products: OpenAI's Codex and Anthropic's Claude Code. Forever's broader point is that any AI agent built to obey an instructions file in its working folder could face the same risk. The sources do not list specific software versions.
The people most exposed are software developers who use AI coding agents, particularly those who launch them from the Downloads folder. Forever's own telemetry, meaning usage data collected from its products, suggests this is common. The firm said roughly half of its customers run a coding agent in Downloads. It also said about a quarter of agent sessions open a web browser. In those sessions the agent does its own browsing, so no person may be watching when a new file appears.
The final stage of the MALFEX campaign is a Windows payload, so Windows machines face the most direct consequence in the Codex scenario. The sources do not identify particular industries or regions as targets.
Forever describes the attack as two harmless behaviours that become dangerous together.
AGENTS.md for Codex and CLAUDE.md for Claude, and act on it. That is a feature: it lets developers tell the agent how a project works.Put the two together and a web page can place something the agent will treat as orders into a folder the agent may already be working in. This is a form of what security researchers often call prompt injection: hiding instructions inside content an AI system will read, so the system follows the attacker instead of its user.
Forever ran the real attacker file against Codex inside an isolated virtual machine, a sealed-off test computer. The file presented its demands as routine project setup. It asked Codex to register a server in the agent's global configuration file, ~/.codex/config.toml, and to run a command that installed the malicious package.
Because that configuration file covers every Codex session on the machine, the change would not stay in Downloads. The attacker's server would load whenever Codex started in any folder afterwards. Forever said Codex ran the malware in more than 90% of its attempts.
Against Claude Code, the working attack took a different form and succeeded less often. A planted CLAUDE.md file, written as internal "gateway setup" documentation, tried to get Claude to write an ANTHROPIC_BASE_URL setting into a project settings file. That setting controls where the agent sends its API traffic, meaning its requests to the AI model. In the test it pointed at a server Forever controlled.
Forever said that one change has two serious effects. It leaks the session's login token, which on its own is enough to take over the account. It also lets the rogue server pose as the AI model and send back commands that the agent then runs.
Claude Code requires a person to approve a file write like this, and it often refuses requests that look suspicious. Even so, the researchers said the long, document-style framing got the write approved about half the time.
No CVE identifier or severity score applies here. That fits Forever's view that this is a design issue, not a software bug. The real-world case was caught and blocked before any code ran, and the sources report no confirmed infections tied to this specific technique.
The ingredients are real, however. The malicious package belongs to a campaign that other researchers have independently documented. The planted file was found on an actual customer's machine. And in Forever's tests, Codex followed the malicious instructions in more than nine out of ten attempts. Claude Code's approval step made success less likely, but only to roughly a coin flip.
Forever argues that the vendors have nothing to fix, because an agent obeying its folder's instructions file is working as designed. It compared the situation to a browser displaying a phishing page: the browser does its job, and the danger lies in the content. "There is nothing here for OpenAI or Anthropic to patch," the company said. Only one outlet has reported on the research, and the sources include no response from OpenAI or Anthropic, so it is not clear whether the vendors agree.
Forever's recommendations do not require buying any product. Based on its advice:
AGENTS.md or CLAUDE.md, whether in Downloads or in a repository you just cloned, should be read carefully before any agent works in that folder.~/.codex/config.toml for server entries or a changed base URL that you did not add..claude/settings.json in your projects for an ANTHROPIC_BASE_URL or any other API endpoint you did not set.AGENTS.md actually got onto the customer's machine. Forever showed a web page could plant it, but not that one did.ITVedas analysis: This case shows that an AI agent's trust in its own instructions file can be turned against its user. Until agent makers treat instructions files with the same suspicion as unknown code, developers should treat every unfamiliar AGENTS.md or CLAUDE.md as potentially hostile.
Want to understand the technology behind this story? ITVedas has beginner-friendly guides on every IT topic.
Explore IT Chapters →