A file saved to the Downloads folder without approval can trick AI coding agents into installing malicious packages or handing over the user’s login token, according to Forever Security. The file, named AGENTS.md, is a plain-text document that developers place in a project folder with instructions for coding agents.
One such file was discovered on a computer belonging to a Forever customer, where it tried to get a coding agent to install a malicious package before the firm’s software stopped it. The file targeted OpenAI’s Codex and was disguised as an ordinary set of engineering guidelines.
The package, called function-color, was part of a malicious campaign on npm, a public library of ready-made JavaScript code. Forever Security says the campaign went unnoticed for roughly two years until it was caught and publicly documented, and npm has since removed the package.
How the Attack Works
Codex follows an AGENTS.md only in a folder it trusts, and the Downloads folder qualifies once the user has worked there. When Codex is opened in that folder and given any task, it first changes its own settings and then installs the package named in the file.
The planted document is 13 KB long and has a mundane tone, which helps it get through undetected. In testing, Codex ran the malware in more than 90% of attempts, and the malicious package was executed once inside an isolated virtual machine.
The settings Codex changes apply to the whole computer, so every later Codex session runs the attacker’s command, whichever project the user opens. This means that if the attacker gains access to the user’s login token, they can take over the account without running any additional code.
Forever Security’s researchers also created a CLAUDE.md file, the equivalent for Anthropic’s Claude Code, and found that Claude was much harder to fool. The attack that worked against Codex looked nothing like the Claude version, and Claude Code followed the malicious instructions about half the time.
Each request from Claude Code carries the user’s login token, a digital key that keeps the user signed in. When the team replayed a captured token against Anthropic’s service, they were treated as the victim and took over the account without executing further code.
Vulnerability and Prevention
Data from Forever Security shows that roughly half of its customers run a coding agent inside the Downloads folder, and about a quarter of agent sessions open a browser. The company’s researchers argue that there is nothing for OpenAI or Anthropic to patch, as the agent is simply obeying the instructions file in its folder.
Instead, users must defend against the attack themselves by keeping agents out of the Downloads folder and reading any AGENTS.md or CLAUDE.md file before letting an agent near it. They should also check agents’ settings files for servers or web addresses they didn’t add, and keep approval prompts and sandboxes switched on.
Anyone who discovers a planted file should assume the login token has leaked and replace it, because a stolen token works as a live session. A computer where function-color was installed should be treated as compromised, and users should be cautious when starting any coding agent in the Downloads folder.
Leave a Reply