Forever Security intercepted a malicious AGENTS.md file placed in a developer's Downloads folder on a customer machine (Forever). The file attempted to lure AI coding tools into installing a malicious npm package before any code ran (The Hacker News).
The technique exploits normal browser behavior and typical AI assistant features. Web pages can drop files into a user's Downloads folder without a click or approval prompt.
Coding assistants automatically read local Markdown files and follow embedded instructions when a directory is opened. Posed as routine engineering notes, the AGENTS.md file instructed OpenAI's Codex to register a custom server in its global configuration file.
Changing the global configuration file propagates the attacker’s commands across all future coding sessions on the system. In isolated tests, Codex carried out the unauthorized configuration commands in over 90 percent of trial runs.
Researchers also evaluated Claude Code with a planted CLAUDE.md file that altered the assistant's API server routing. That variant tried to redirect traffic to an external server, risking exposure of session tokens and potential account compromise.
The targeted package, function-color, belongs to the MALFEX npm supply-chain malware campaign (Checkmarx). Checkmarx reports the campaign has published twelve packages to npm since August 2023.
Within MALFEX, function-color pulls in function-flag, a downloader that delivers Windows payloads. Checkmarx observed function-flag has contained malicious code since July 2025 and accounts for most of the campaign's downloads.
The reliance of AI agents on local instruction files creates an expanded attack surface that bridges web navigation with local system execution. Because browsers can silently place files into default download locations, malicious sites do not need to exploit software bugs to deliver rogue agent instructions. Security strategy must adapt to treat local instruction files as untrusted input. Development environments will likely need permission controls around agent workspace directories and strict domain restrictions for silent browser file writes.
Spotted an error? See our corrections policy or email editorial@lordofclaude.com.
Discussion & Comments (0)
Join the conversation