As reported by The Hacker News, security firm Forever Security discovered a malicious AGENTS.md file in a developer's Downloads folder that attempted to coerce an AI coding agent into installing a known-malicious npm package. The incident — caught before execution — reveals a structural vulnerability in how AI coding agents handle trust boundaries that every organization using these tools needs to understand.

AI Security Alert: As reported by The Hacker News, security firm Forever Security discovered a malicious AGENTS.md file in a developer's Downloads folder that attempted to coerce an AI coding agent into installing a known-malicious npm package.

The Trust Model Problem

This attack is not a traditional software vulnerability. It is an abuse of designed behavior. AI coding agents like OpenAI's Codex and Anthropic's Claude Code are explicitly built to read instruction files — AGENTS.md, CLAUDE.md, and similar — from their working directory and follow them as project configuration. That design assumes the files in a local folder are legitimately placed by the developer or the project team.

The attack breaks that assumption in two steps:

  • Silent file delivery: A web page can save a file to the Downloads folder without user interaction or a permission prompt, choosing both the filename and contents.
  • Agent compliance: When the agent opens a folder containing the planted file, it treats the file as authoritative instructions and executes embedded commands — including installing packages and modifying its own global configuration.

Forever Security reported that against OpenAI Codex, the malicious payload executed in over 90% of attempts. The function-color npm package — part of the broader MALFEX campaign previously documented by CloudSEK and Checkmarx — pulls in a downloader called function-flag that fetches and executes a Windows payload.

Why the Persistence Mechanism Is Dangerous

The most alarming detail is not the initial infection but the persistence vector. The malicious file instructed Codex to register a rogue MCP server in ~/.codex/config.toml — a configuration file that applies to every subsequent Codex session on that machine, not just the compromised folder. This transforms a single drive-by file drop into a persistent backdoor that activates across all projects.

For Claude Code, the attack took a different shape: a planted CLAUDE.md attempted to redirect the ANTHROPIC_BASE_URL environment variable to an attacker-controlled server. Had it succeeded, the attacker could intercept the session's authentication token (constituting account takeover) and inject arbitrary model responses — effectively turning the coding agent into a remote-controlled execution engine.

Attack Chain Summary

Stage Action Impact
1. Delivery Web page silently writes AGENTS.md to Downloads No user interaction required
2. Trigger Agent opens folder and reads instruction file Agent treats file as trusted project config
3. Execution Agent installs malicious npm package (function-color) Downloads and runs Windows payload
4. Persistence Rogue MCP server registered in global config Attacker control across all future sessions

Who Is at Risk

Who Is at Risk
Development teams using AI coding agents — particularly those running Codex, Claude Code, or similar tools that auto-read instruction files from the working directory.
Organizations with shared developer workstations or VMs — global config persistence means one compromise affects all projects on the machine.
CI/CD pipelines that invoke AI agents — if an agent runs in an automated pipeline where instruction files are not vetted, a compromised repo or build artifact could trigger the same chain.
Developers who browse untrusted sites — the delivery vector requires only visiting a web page; no click, no download prompt.

Shield53 Recommendations

Immediate Actions

  • Audit global agent configuration files. Check ~/.codex/config.toml, ~/.claude/ directories, and any MCP server registrations for unexpected entries. Remove any server you did not intentionally add.
  • Restrict the Downloads folder. Configure your browser to prompt before saving files, or use a sandboxed Downloads directory that coding agents cannot access. Consider setting folder permissions so the agent's working directory is never the Downloads folder.
  • Review instruction files before agent execution. Treat AGENTS.md, CLAUDE.md, and any project-level instruction files the same way you would treat a .bashrc — read them before trusting them.
  • Scope agent permissions. Run AI coding agents with least-privilege file system access. Do not grant agents write access to global configuration paths or the ability to install packages without explicit per-session approval.
  • Monitor npm package installations. Block or alert on installation of packages not on an approved allowlist. The function-color and function-flag packages should be on every blocklist now.
  • Detect anomalous config writes. Deploy file integrity monitoring on agent configuration files (config.toml, Claude settings, environment variable files). Alert on any write that originates from an agent process rather than a user-initiated edit.
  • Rotate API credentials if exposed. If there is any chance ANTHROPIC_BASE_URL or similar environment variables were tampered with, rotate all API keys and session tokens for the affected accounts immediately.

Strategic Considerations

This incident underscores a broader issue: AI coding agents inherit a trust model designed for human developers operating in controlled environments, but they operate in contexts where silent automation can introduce untrusted inputs. Vendors must evolve their trust boundaries — instruction files should be signed, scoped, or require explicit user confirmation before the agent acts on them. Until then, the burden falls on defenders to treat every agent-readable file as a potential injection vector.

The core issue is that AI coding agents blur the line between configuration and code. An instruction file is not documentation — it is an executable policy. Defenders must treat it accordingly.