Malicious Downloads-Folder File Tried to Make AI Coding Agents Install Malware
Summary
Forever Security says it stopped a malicious AGENTS.md file on a customer machine before code ran. Tests showed how silently downloaded instructions could target Codex and Claude Code; the file’s arrival route in the customer case is unknown.
Key points
- Forever Security said it found a malicious AGENTS.md file on a customer’s machine and stopped the agent before code ran; it could not establish how the file arrived.
- The file directed the agent to install function-color, which pulls in the function-flag downloader and a Windows payload. Researchers named the campaign MALFEX.
- A proof-of-concept page silently downloaded AGENTS.md to a Downloads folder, demonstrating a possible delivery path—not establishing that this is how the customer’s file arrived.
- In isolated tests, Forever Security said Codex ran the malware in more than 90% of attempts after instructions added a server to ~/.codex/config.toml, a setting that applies to later Codex sessions across folders.
- In tests against Claude Code, a CLAUDE.md file tried to redirect API traffic through a server controlled by Forever Security. Researchers said this could expose the session login token and allow the server to return commands for the agent to run.
- Researchers said Claude Code required human approval for the settings change and approved it about half the time when the request was framed as engineering documentation.
Article Details
- Attack Vectors
- A malicious AGENTS.md file posed as engineering notes instructs a coding agent to register an attacker-controlled server and install the malicious npm package function-color. The reported customer attempt was stopped before code ran.
- A proof-of-concept page silently downloads an AGENTS.md file to the Downloads folder; researchers did not establish that this was how the file reached the customer machine.
- The reported Codex test changes ~/.codex/config.toml, which applies to later Codex sessions across folders, and directs the agent to install function-color. Forever Security reported that Codex ran the malware in more than 90% of its attempts.
- In a Claude Code test, a planted CLAUDE.md file directs the agent to set ANTHROPIC_BASE_URL to a server controlled by Forever Security. Researchers said this would expose the session login token and let the server return commands for the agent to run; approval was obtained about half the time.
- Researchers at CloudSEK and Checkmarx documented a related campaign in which function-color pulls in function-flag, which fetches and runs a Windows payload. They named the campaign MALFEX.
- Defensive Notes
- Avoid running coding agents in Downloads folders, which a web page may be able to write to without a click or permission prompt.
- Review instruction files and scrutinize agent-requested changes to configuration files, API endpoints, and package installations before approving them.
- Consider that agent configuration changes may affect later sessions, not only the folder where the change was made.
- Be aware that roughly a quarter of agent sessions in Forever Security's telemetry opened a browser; the article identifies this as a condition that can leave browsing and file arrival unwatched.
MITRE ATT&CK
T1105 · Ingress Tool TransferThe article says the function-flag downloader fetches a Windows payload as part of the related malware campaign documented by CloudSEK and Checkmarx.T1528 · Steal Application Access TokenIn the Claude Code test, researchers said redirecting API traffic to a Forever-controlled server would expose the session's login token, enabling account takeover.
Products
Claude CodeAgainst Claude Code, the working attack looked different and succeeded less often. A planted CLAUDE.md, framed as internal gateway setup, tried to make Claude write an ANTHROPIC_BASE_URL into a project settings file,CodexThe file was AGENTS.md, a plain-text instructions file that a coding agent, such as OpenAI's Codex, reads when it starts in a folder and follows as directions.