AI Coding Agents Can Be Turned by a File in Downloads

Security researchers at Forever Security caught a live attempt to hijack a customer's AI coding agent last week — and the weapon was a Markdown file sitting in the Downloads folder. The file, disguised as ordinary engineering notes, instructed OpenAI's Codex to install a known-malicious npm package. The install was blocked before any code ran. But the firm's follow-up testing, reported by CSO Online and The Hacker News, showed the technique works against both Codex and Anthropic's Claude Code with uncomfortable reliability.

Here's the part that should get your attention before the hype does: there is no vulnerability to patch. No CVE, no exploit chain, no clever memory corruption. The agent did exactly what it was sold to do — read the instructions file in its working directory and obey it. The attacker's entire contribution was a text file with the right name in the right folder. If that doesn't reframe how you price agent autonomy, nothing will.

What actually happened on the customer's machine

Forever Security found a malicious AGENTS.md file in a customer's Downloads folder. AGENTS.md is the plain-text file Codex reads when it starts in a directory, treating its contents as project instructions. Claude Code has an equivalent convention with CLAUDE.md. Neither file format executes anything on its own — that's the whole trick. The agent does the executing, with whatever permissions the developer granted it.

The recovered file was dressed up as routine project setup. One section told the agent to register a server in its own configuration and install an npm package called function-color. That package is not hypothetical malware: researchers at CloudSEK and Checkmarx have separately documented it as part of a campaign they named MALFEX, in which function-color pulls in a downloader called function-flag that fetches and runs a Windows payload. So this wasn't a proof of concept that wandered onto a developer's disk. Someone aimed a real supply-chain campaign at a real agent, and it got caught by luck and a control, not by the agent's judgment.

How did the file get into Downloads? Forever doesn't know. What it demonstrated is a plausible delivery path: a web page can save a file to the Downloads folder silently, choosing the name and contents, without a click or permission prompt. The firm built its own proof-of-concept page that drops an AGENTS.md into Downloads on a visit. Whether the actual attacker used that route is unconfirmed — and anyone telling you otherwise is overselling the evidence.

Confirmed, claimed, and unknown

Strip the story down to its evidentiary layers, because they aren't equal.

Confirmed: A malicious AGENTS.md existed on a real customer machine and directed Codex to install function-color. The installation was blocked before execution. The package is tied to the documented MALFEX campaign. Those are facts with an incident behind them, not a lab demo.

Demonstrated by the researchers, not observed in the wild: Running the real attacker file against Codex in an isolated VM, Forever got the agent to follow the malicious instructions in more than 90% of tests, most using a harmless stand-in for the malware. Worse, the file told Codex to modify ~/.codex/config.toml — its machine-wide MCP server configuration — and launch a new session with approval and sandbox restrictions bypassed. Because that config applies to every session, the attacker's server would load in any directory afterward. The attack persists after the developer walks away from Downloads. That's the detail that elevates this from parlor trick to design flaw.

Against Claude Code, the working variant was different and less reliable. A planted CLAUDE.md, framed as internal gateway setup, tried to get the agent to write an ANTHROPIC_BASE_URL into a project settings file, redirecting API traffic to a researcher-controlled server. That one write leaks the session's login token — account takeover by itself — and lets the fake server reply as the model and hand back commands. Claude requires human approval for such writes and often refuses suspicious ones; the engineering-doc framing got approved about half the time. The researchers also replayed a captured OAuth token against the legitimate API, proving the token theft is exploitable, not theoretical.

Unknown: The delivery vector in the real incident, the prevalence of the technique beyond this one attempt, and whether any organization has actually been breached this way. Sakshi Grover, senior research manager for cybersecurity products and services for Asia/Pacific at IDC, called the research a credible early warning rather than evidence of widespread exploitation, and noted the success rates haven't been independently validated. Keep that calibration. One caught attempt plus solid lab reproduction is a reason to deploy cheap controls, not a reason to panic-buy an agent security platform.

"There is nothing here for OpenAI or Anthropic to patch," Forever Security said, comparing the technique to a browser rendering a phishing page — the browser worked as designed, and the attack lies in the page.

The architectural bill comes due

I've watched enterprises hand production credentials to tools with less identity governance than a summer intern gets, and coding agents are the latest round of that habit. Akshat Tyagi, associate practice leader at HFS Research, put his finger on the design problem: these tools treat following an instruction and granting a privilege as the same act. A Markdown file that any web page can silently write should not be able to reconfigure an agent's sandbox settings or register a persistent MCP server. Yet it can, because the agent can't tell the difference between an instruction to run a build command and an instruction to rewrite its own security boundary.

And the exposure isn't exotic. Forever's own telemetry says about half its customers run a coding agent in their Downloads folder, and roughly a quarter of agent sessions open a browser. Read those two numbers together: the agent sits where the web can write, and a meaningful share of the time the agent does the browsing itself, so no human is watching when a file lands. Grover's warning generalizes it — the Downloads folder is just the convenient case. Cloned repositories, shared drives and package contents are all places agents ingest untrusted content while holding live credentials. We covered a flavor of this with the LiteLLM backdoor that went after GitHub tokens: the pattern is agents and pipelines holding credentials that attackers can reach through trusted-looking inputs.

Meanwhile, 40% of respondents to an Omdia Cybersecurity Decision-Maker survey were only somewhat confident or not confident in their organization's ability to secure AI agents, according to Omdia senior analyst Jonathan Ong. Given what a text file in Downloads can do, I'd call that 40% the honest ones.

Guardrails worth their cost — and the math

Now the part I actually care about: what does this cost to fix, versus what does it cost to eat? The fix list is almost embarrassingly cheap. Forever's own recommendations require no purchase at all:

• Never start Codex, Claude Code or any agent in ~/Downloads — the one folder the web can write to on its own.
• Hunt for instruction files you didn't write: a stray AGENTS.md or CLAUDE.md in Downloads or a freshly cloned repo is the entire attack. Read it before the agent does.
• Audit the agent's own config: watch for unexpected server blocks in ~/.codex/config.toml and for ANTHROPIC_BASE_URL or unfamiliar API endpoints in a project's .claude/settings.json.
• Keep approval prompts and sandboxes on, and treat any instruction telling the agent to disable them as hostile by definition.
• If you find a planted file, assume the login token leaked and rotate it — a stolen token is a live session.

That's an afternoon of policy and a few detection rules, not a budget line. Ong adds one worth enforcing at the platform level: disable flags like --dangerously-bypass-approvals-and-sandbox so the agent simply lacks the authorization to run high-risk actions. When a vendor names a flag "dangerously," believe them.

The slightly pricier controls come from Amit Kumar Jena, development manager for AI at Kanerika, and they map to governance you should already have: treat instruction files like source code, with designated owners reviewing changes to AGENTS.md, CLAUDE.md and related config directories; route software installs through internal registries or scanning proxies; and for developers with production credentials on their machines, use isolated dev environments with shorter-lived tokens. Jena framed the principle cleanly: an instruction file can change what the agent tries — it must never change what the agent is allowed to do. Grover's complementary ask of vendors is origin verification and explicit approval for instruction files from untrusted sources, instead of treating every Markdown file as authoritative.

The verdict

Is this the apocalypse? No. It's one blocked attempt, lab reproduction with varying success rates, and an unvalidated delivery vector. Grover is right that it's an early warning, not a body count. But early warnings are precisely when controls are cheap. The attack surface here is your own agents' willingness to obey, running with your developers' credentials, in a folder half your org apparently uses as a workspace.

The board question writes itself: what can an agent with a developer's tokens do if it reads the wrong file, and what did we spend to bound that answer? If the honest reply is "we haven't bounded it," then an afternoon of directory policy, config audits and token hygiene is the best return on investment you'll get this quarter. Act now — not because the sky is falling, but because the fix is nearly free and the failure mode is your own tool betraying you with your own credentials.