AI Coding Agents Tricked Into Installing Malware Through Downloads Folder Vulnerability

AI Agents Hijacked Through Malicious Instruction Files

Forever Security blocked a live attack where a malicious AGENTS.md file in a customer's Downloads folder attempted to trick AI coding agents into installing a rogue npm package called function-color1

1

. The security vulnerability affects popular AI coding agents including OpenAI Codex and Claude Code, exploiting how these tools automatically process project-specific instructions from markdown files2

2

. The attack represents a design flaw rather than a software bug, as AI agents are built to follow instructions from AGENTS.md and CLAUDE.md files when operating in directories where these files are present3

3

.

The researchers could not determine how the original file reached the customer's computer, but demonstrated that malicious websites can trigger downloads of these instruction files without separate approval prompts1

1

. The Downloads folder presents a unique risk because it is the one location where web browsers can write files automatically without user interaction2

2

. Forever Security's internal statistics show that hundreds of customers run AI agents from their Downloads folders, with Claude Code alone launching more than 1,300 sessions from that location2

2

.

How the Attack Exploits AI Agent Behavior

The malicious instruction files contain no executable code, instead relying on AI agents interpreting their contents as legitimate instructions and carrying them out with existing permissions1

1

. In tests using the file recovered from the customer's machine, Forever Security found that OpenAI Codex could be manipulated into modifying its machine-wide MCP server configuration and launching another session with approval and sandbox bypasses1

1

. The attack succeeded in more than 90% of tests against Codex, with most using a harmless substitute for the malware2

2

.

Because the malicious server was registered in Codex's machine-wide configuration files, it could be loaded in subsequent sessions even after developers moved to another directory1

1

. A separate demonstration against Claude Code showed that a malicious CLAUDE.md file could redirect the agent's API traffic redirection to a researcher-controlled server, exposing OAuth tokens and allowing the server to supply commands for execution1

1

. This configuration manipulation succeeded in approximately 50% of tests, and researchers successfully replayed a captured OAuth token against the legitimate API, demonstrating potential for account compromise1

1

.

Broader Implications and Design Weaknesses

The findings expose a fundamental design flaw in AI coding agents, which are expected to follow project instructions but may also have access to sensitive configuration files and execution privileges1

1

. Akshat Tyagi, associate practice leader at HFS Research, noted that the deeper issue is these tools treat following an instruction and granting a privilege as the same act1

1

. There is nothing for OpenAI or Anthropic to patch, as an agent following the AGENTS.md in its folder is doing exactly what it was built to do2

2

.

Sakshi Grover, senior research manager for cybersecurity products at IDC, emphasized that the more consequential risk is not the Downloads folder specifically but the broader pattern of AI agents ingesting untrusted content while holding live credentials1

1

. Attackers could adapt this technique to other locations accessible to AI coding agents, including cloned repositories, shared drives, and package contents1

1

. The npm package function-color involved in the attack is part of a malware campaign documented by CloudSEK and Checkmarx researchers, who named it MALFEX3

3

. This package pulls in a downloader called function-flag, which fetches and runs a Windows payload3

3

.

Enterprise Security Concerns and Recommendations

The security vulnerability emerges amid broader uncertainty over enterprises' ability to secure autonomous agents. An Omdia Cybersecurity Decision-Maker survey found that 40% of respondents were only somewhat confident or not confident in their organizations' ability to secure AI agents1

1

. Jonathan Ong, senior analyst for managed security services at Omdia, recommended human oversight to identify suspicious agent behavior and restrictions on settings that allow AI agents to bypass security controls1

1

.

Users should avoid setting the Downloads folder as an AI coding agent's working directory because the location may contain untrusted files that the agent could interpret as instructions2

2

. OpenAI and Anthropic recommend running their AI coding agents from the project directory they are intended to work on, keeping the working directory scoped to the relevant project to provide appropriate context and limit working scope2

2

. Developers should look for instruction files they did not write, especially stray AGENTS.md or CLAUDE.md files in Downloads or cloned repositories3

3

. Checking agent configuration files for unexpected server blocks or changed base URLs is critical, as is leaving approval prompts and sandbox bypasses enabled3

3

. If a planted file is discovered, users should assume OAuth tokens leaked and rotate them immediately, as a stolen token represents a live session3

3

.