AI Coding Agents Targeted via Malicious AGENTS.md Downloads

Security firm Forever Security recently caught a novel attack vector operating in the wild on a customer’s machine: a malicious context instruction file sitting in a developer’s local Downloads directory that attempted to trick an active AI coding agent into installing a malware-laden npm package. While the agent was intercepted before executing any code, the incident highlights a critical exposure window created by how modern terminal-based AI tools process localized workspace configuration files.

The core vulnerability relies on indirect prompt injection combined with native browser file-handling behavior. Modern AI developer tools—including OpenAI’s Codex CLI and Anthropic’s Claude Code—are designed to parse repository-level instruction files when initialized inside a directory. Files like AGENTS.md or CLAUDE.md serve as system directives, establishing coding standards, environment configurations, and setup commands that the model treats as trusted operational guidance. Because standard web browsers allow web pages to initiate silent downloads into a user’s default ~/Downloads directory without explicit user prompts, a malicious site can easily drop a weaponized instruction file onto a developer’s disk. When a developer later launches an AI coding agent from that same Downloads directory, the agent automatically reads and obeys the dropped instructions.

Anatomy of the Instruction Injection Attack

In the observed attack, the planted file was named AGENTS.md and framed convincingly as standard engineering setup notes. Among routine project documentation, the file instructed the agent to modify its underlying configuration and install an npm package named function-color.

When Forever Security replicated the attack against OpenAI Codex inside an isolated virtual machine, the results demonstrated remarkably high success rates. The malicious AGENTS.md file directed Codex to register an external server within its persistent configuration file at ~/.codex/config.toml and execute an installation command for function-color. Codex followed these injected directives in over 90% of test runs. Crucially, modifying config.toml impacts every subsequent Codex session across the entire machine, effectively elevating a local directory payload into persistent global agent hijacking.

The attack vector against Anthropic’s Claude Code required a different structure due to the tool’s permission controls. Researchers introduced a planted CLAUDE.md file designed to look like internal gateway configuration instructions. The file instructed Claude Code to write an explicit ANTHROPIC_BASE_URL directive into the project’s local .claude/settings.json file, redirecting the agent’s API traffic to an attacker-controlled server.

Because Claude Code prompts the human user for approval before writing or modifying configuration files, the attack relies on social engineering the user through the agent’s summary prompt. By embedding long, realistic engineering documentation framing around the request, the attack successfully tricked users into approving the settings write in approximately 50% of test attempts. Once the ANTHROPIC_BASE_URL is redirected, the attacker receives the developer’s raw Anthropic session login token—resulting in immediate account takeover—and gains the ability to impersonate the model backend to return arbitrary bash commands directly to the agent.

Malware Integration and Blast Radius

The npm package specified in the attack, function-color, is a known malicious component tied to an ongoing supply chain campaign documented by CloudSEK and Checkmarx under the name MALFEX. Upon installation, function-color imports a secondary dependency named function-flag, which acts as a staging downloader to fetch and run a final Windows executable payload.

The blast radius for targeted organizations is significant. Developer workstations hold elevated access, including cloud infrastructure credentials, source code repositories, SSH keys, and internal API tokens. A successful compromise via an AI coding agent grant an attacker full code execution within the developer’s context. Furthermore, telemetry published by Forever Security indicates that approximately 50% of enterprise developers regularly launch coding agents directly inside their ~/Downloads directory, and roughly 25% of agent sessions involve the agent autonomously opening a browser—creating ideal conditions where an agent can download a payload and subsequently execute it without direct human oversight.

Because these agents are functioning exactly as designed by honoring localized instruction files, vendors like OpenAI and Anthropic have no direct logic bug to patch. The trust model itself is the attack surface, analogous to a web browser faithfully rendering a phishing site.

Defensive Guidance and Mitigation

Securing environments against workspace instruction injection requires strict operational discipline around agent execution contexts and configuration integrity.

• Isolate Agent Launch Paths: Never execute codex, claude, or any terminal-based AI coding agent within ~/Downloads or other uncurated directories where web browsers or automated scripts write incoming files.
• Inspect Context Files: Prior to running an agent in any newly cloned repository or shared directory, inspect for untrusted AGENTS.md, CLAUDE.md, .cursorrules, or similar markdown/configuration files. Treat instructions that require network requests, package installations, or base URL changes as untrusted code.
• Audit Agent Configurations: Inspect persistent configuration files for unauthorized server blocks or modified API endpoints. Check ~/.codex/config.toml for unauthorized custom servers and audit .claude/settings.json in local projects for unexpected ANTHROPIC_BASE_URL entries.
• Maintain Strict Prompt Approvals: Do not disable interactive sandbox prompts or auto-approve configuration file writes. If an agent requests permission to edit configuration files or establish external network endpoints, verify the request manually.
• Credential Rotation: If a planted context file or suspicious API redirect is discovered in an active agent directory, treat the active session token as compromised. Immediately revoke and rotate all associated Anthropic or OpenAI API keys and session tokens.