The cybersecurity firm Forever Security has reported an attack technique in which a malicious instruction file placed inside a developer’s Downloads folder attempted to influence an artificial intelligence (AI) coding agent into installing a known malicious software package. The company stated that it detected the activity on a real customer machine and stopped the AI agent before any code execution took place. Researchers said they could not determine how the file originally reached the Downloads folder. The file identified in the investigation was AGENTS.md, a plain-text instruction file that AI coding agents can read when starting work inside a folder. These files are designed to provide directions and project-related information to coding assistants. According to Forever Security, the malicious file was disguised as normal engineering documentation and contained instructions that attempted to convince the AI agent to add a server configuration and install a package called function-color from the npm ecosystem.
Researchers stated that function-color is associated with a previously identified malware campaign. The package reportedly downloads another component called function-flag, which can then retrieve and execute a Windows payload. Security researchers from CloudSEK and Checkmarx have separately analyzed the campaign and referred to it as MALFEX. Forever Security explained that the attack method relied on combining two separate behaviors that are normally considered legitimate: AI agents following instruction files in their working environment and websites being able to save files to a Downloads folder without requiring a direct user action in some situations. The company clarified that it did not confirm that the customer’s machine was compromised through this exact method. However, to demonstrate that the attack path was technically possible, researchers created a proof-of-concept webpage that could silently place an AGENTS.md file into a Downloads folder. They then tested the technique against multiple AI coding agents to understand how different systems handled the instructions.
During testing with OpenAI Codex, Forever Security used an isolated virtual machine containing the attacker-style instruction file. Researchers said the file appeared as routine project setup information and instructed Codex to register a server in the agent configuration file and execute a command that installed the malicious npm package. The company reported that the change could affect future Codex sessions because the configuration applied beyond the original folder environment. According to the researchers, Codex followed the instructions in more than 90% of their attempts. The researchers also tested a similar approach against Claude Code, where the attack focused on modifying project settings and changing an API endpoint through an ANTHROPIC_BASE_URL entry. Forever Security stated that this method could expose session credentials and allow a remote server to send responses that appear to come from the AI model. However, the company noted that Claude Code generally requires user approval for such changes and the technique succeeded less frequently during testing.
Forever Security said the issue does not necessarily represent a software flaw in AI coding tools because these systems are designed to follow instructions provided within their working environments. The company compared the situation to traditional phishing methods, where a system operates normally but is influenced by harmful external content. Researchers recommended that developers avoid running AI coding agents directly inside Downloads folders, review unfamiliar instruction files such as AGENTS.md or CLAUDE.md before allowing AI tools to process them, and monitor configuration files for unexpected changes. They also advised users to keep approval settings and sandbox protections enabled and rotate access tokens if suspicious files are discovered. The report highlights emerging security considerations as AI coding assistants become more common in software development workflows. As these tools gain greater access to files, configurations and development environments, cybersecurity researchers emphasize the need for stronger awareness around AI agent permissions, safe deployment practices and careful review of automated instructions.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
