Malicious File Tricks AI Coding Agent into Installing Malware
A malicious instruction file in a developer's Downloads folder attempted to trick an AI coding agent into installing a known-malicious npm package, highlighting new supply-chain risks.
Security researchers have uncovered a novel attack vector where a malicious instruction file, disguised as ordinary engineering notes, attempted to manipulate AI coding agents into installing malware. The incident, detected by security firm Forever Security on a customer's machine, involved an AGENTS.md file placed in a developer's Downloads folder. This file instructed an AI agent, such as OpenAI's Codex, to add a server to its configuration and install a package named function-color from the npm registry.
The function-color package is part of a known malware campaign, dubbed MALFEX by researchers, which includes a downloader that fetches and executes a Windows payload. The attack exploits two key factors: AI coding agents are designed to trust and execute instructions found in files within their working directory, and web pages can silently save files to the Downloads folder without user interaction or explicit permission prompts. This combination allows an attacker to drop a malicious instruction file into a location the AI agent will readily trust and act upon.
Forever Security successfully reproduced the attack in a controlled environment. When tested against OpenAI's Codex, the AGENTS.md file instructed the agent to modify its configuration file (~/.codex/config.toml) to register a malicious server. This change would cause any subsequent Codex session on the machine to connect to the attacker's server, leading to malware execution in over 90% of test attempts. The modification to the global configuration file meant the compromise extended beyond the initial folder.
The attack was also tested against Anthropic's Claude Code, revealing a slightly different but equally concerning mechanism. A file named CLAUDE.md attempted to trick the agent into writing an ANTHROPIC_BASE_URL into a project settings file, redirecting API traffic to a server controlled by Forever Security. This redirection could lead to the leakage of the agent's session token, enabling account takeover and allowing the attacker's server to issue commands back to the agent.
While Claude Code requires user approval for such configuration changes, the malicious instruction file was framed as part of a legitimate internal setup process. This social engineering tactic succeeded in getting the write operation approved approximately half the time, demonstrating the effectiveness of blending malicious commands within plausible scenarios. The researchers noted that the AI agents were functioning as designed by following instructions, placing the onus on users and developers to implement safeguards.
Forever Security emphasized that there are no specific vulnerabilities for OpenAI or Anthropic to patch, likening the situation to a web browser rendering a phishing page. The core issue lies in the trust placed in instruction files and the ability of web pages to write files to the Downloads folder. The firm recommends several practical steps for developers to mitigate this risk.
Key recommendations include avoiding running AI coding agents in the Downloads folder, meticulously checking for unfamiliar instruction files (AGENTS.md, CLAUDE.md, etc.) before allowing an agent to operate, and scrutinizing agent configuration files for unauthorized server entries or modified API endpoints. Users are also advised to keep approval prompts and sandboxing features enabled and to be wary of any instructions that suggest disabling these security measures.
Telemetry data from Forever Security indicates that a significant portion of its customers run coding agents in their Downloads folder, and many agent sessions involve direct web browsing. These conditions create a fertile ground for such attacks, especially when agents operate without direct human oversight during file arrival and execution. The incident highlights a new frontier in supply-chain attacks, targeting the very tools designed to accelerate development.