Cybersecurity
Instruction file tried to install malware through coding agents
Forever Security said a planted AGENTS.md in a customer’s Downloads folder tried to make an AI coding agent install a malicious npm package, and it reproduced related attacks against Codex and Claude Code.
- Forever Security said it found AGENTS.md in a developer’s Downloads folder on a real customer machine and stopped the attempt before any code ran.
- The file asked an agent to change its configuration and install function-color from npm, which other researchers had linked to the MALFEX campaign.
- Forever Security said it could not determine how the file reached the folder and did not establish that the same delivery route was used in the customer case.
- In tests, the company said Codex followed the malicious instructions in more than 90% of attempts, while a related Claude Code attack succeeded less often.
Forever Security said it found a planted AGENTS.md file in a developer’s Downloads folder and blocked the attempt before any code executed. It said the file was written to look like normal engineering notes and was meant to steer an AI coding agent into following its instructions.
The file directed the agent to alter its own configuration and install function-color from npm. Forever said that package sat inside a separate malware chain that CloudSEK and Checkmarx had identified as MALFEX, with function-flag used to fetch a Windows payload.
The company said a web page can save a file into Downloads without a click or prompt, and it built a proof-of-concept page to show that an AGENTS.md could arrive that way. It said it had not established that a real attacker used that route in the customer case.
Forever then tested the technique against Codex and Claude Code. In its Codex test, the file caused the agent to register a server in its configuration and run the install command; in the Claude Code test, a CLAUDE.md file tried to change a project setting so traffic went through a server controlled by Forever, which the company said could expose the session token and allow command injection.
Named in this story
Companies
- Forever Security
- said it found the planted instructions file and tested the attack
- OpenAI
- is the company behind Codex
- CloudSEK
- analysed the MALFEX campaign
- Checkmarx
- analysed the MALFEX campaign
- Anthropic
- is the company behind Claude Code
Products and systems
- AGENTS.md
- the instructions file used to steer a coding agent
- Codex
- the coding agent that Forever said could be steered into running the package
- function-color
- the npm package the file tried to make the agent install
- function-flag
- the downloader pulled in by function-color
- MALFEX
- the malware campaign name given to the package chain
- Claude Code
- the second coding agent Forever tested
- CLAUDE.md
- the instructions file used in the Claude Code test
How the source tells it
The article was mostly a plain security report, with a brief advisory register at the end.
- urgency the closing guidance uses direct instructions and warnings about Downloads, tokens and approval prompts