Malicious AGENTS.md files exploit AI coding agents via Downloads folder

A malicious instruction file placed in a developer's Downloads folder attempted to coerce an AI coding agent into installing malware, according to a report by security firm Forever Security published last week. The incident highlights a novel attack vector where trusted local files are used to inject commands into agents like OpenAI's Codex and Anthropic's Claude Code.

What happened

Forever Security detected the attempt on a real customer's machine and intervened before any code executed. The malicious file was named AGENTS.md, a plain-text document that coding agents read for context and instructions when initialized in a directory. Disguised as routine engineering notes, the file contained a directive for the agent to modify its configuration and install an npm package called function-color. This package is linked to the MALFEX malware campaign, previously analyzed by researchers at CloudSEK and Checkmarx. The function-color package acts as a downloader for function-flag, which subsequently fetches and executes a Windows payload.

The attack relies on two benign behaviors combining dangerously. First, coding agents are designed to trust and follow instructions found in local files like AGENTS.md or CLAUDE.md. Second, web browsers can save files to the Downloads folder automatically without user interaction or permission prompts. While Forever Security could not confirm exactly how the file reached the customer's machine, they demonstrated that a webpage could silently drop such a file. In their proof-of-concept, visiting a specific page resulted in an AGENTS.md file appearing in the Downloads folder, ready to be executed by any agent started in that directory.

To validate the threat, researchers reproduced the attack in isolated environments. When targeting Codex, the malicious file instructed the agent to register a server in ~/.codex/config.toml and run a command to install the package. Because this configuration file applies globally, the change would persist across all future sessions. Codex executed the malware in more than 90% of test attempts. Against Claude Code, the attack involved a CLAUDE.md file attempting to write an ANTHROPIC_BASE_URL to project settings, redirecting API traffic to a attacker-controlled server. This would leak login tokens and allow the attacker to impersonate the model. Due to Claude's approval requirements, this variant succeeded only about half the time.

How it works

This technique is a form of prompt injection via local file system artifacts. Coding agents operate by scanning their working directory for context files, such as AGENTS.md, which provide guidelines for behavior. By placing a malicious version of this file in a directory the agent trusts, attackers can override safe behaviors with harmful instructions. The agent interprets these text-based commands as legitimate user intent.

The vulnerability is exacerbated by the default behavior of web browsers and operating systems. The Downloads folder is a common landing zone for files from the internet, yet it is also a frequent starting point for developers initializing new projects or testing code. Since browsers can write to this folder without explicit consent for each file, an attacker can plant the trigger mechanism remotely. Once the agent starts in that folder, it reads the malicious instructions as if they were part of the project's legitimate documentation.

Key details

• The malicious file AGENTS.md instructed agents to install function-color, an npm package associated with the MALFEX malware campaign.
• Codex executed the malicious payload in over 90% of attempts when launched from the infected directory.
• Claude Code attacks targeted ANTHROPIC_BASE_URL settings to steal session tokens, succeeding in approximately 50% of cases due to approval prompts.
• Web browsers can silently save files to the Downloads folder, enabling remote planting of malicious instruction files.
• Forever Security states there is no patch for OpenAI or Anthropic, as agents are functioning as designed by following local instructions.
• Telemetry indicates roughly half of Forever Security's customers run coding agents in their Downloads folder.

Why it matters

For software engineers and technical leads, this incident underscores the risk of treating AI agents as fully autonomous entities without strict boundary controls. The assumption that local files are safe is no longer valid when those files can be injected via web browsing activities. Developers who habitually start coding sessions in their Downloads folder or clone repositories directly into it are particularly vulnerable. The attack does not require complex exploits; it leverages the core functionality of the tools developers rely on daily.

Furthermore, the persistence mechanism in Codex, which modifies global configuration files, means a single successful infection can compromise all future agent sessions on a machine. For Claude Code, the risk involves credential theft, which can lead to account takeover and unauthorized access to proprietary codebases. Since the vendors view this as a usage pattern issue rather than a software bug, the responsibility for mitigation falls entirely on the end users and their operational security practices.

What you can do

• Never initialize AI coding agents like Codex or Claude Code in the ~/Downloads directory.
• Inspect any AGENTS.md or CLAUDE.md files in new or downloaded repositories before allowing an agent to read them.
• Regularly audit ~/.codex/config.toml for unauthorized server entries and .claude/settings.json for changed API endpoints.
• Keep approval prompts and sandboxing features enabled, and reject any agent requests to disable them.
• If a malicious instruction file is discovered, assume session tokens have been compromised and rotate them immediately.
• Be cautious when using agents to browse the web, as they may inadvertently download malicious files without user visibility.