About half of Forever Security’s customers run a coding agent in their Downloads folder, and roughly a quarter of agent sessions open a browser — conditions that, the company says, let a single stray file turn an assistant into an installer.
How a plain-text file tried to turn an agent into an installer
Forever Security reported that a real customer's machine contained a plain-text instructions file named AGENTS.md in the developer's Downloads folder. The firm intercepted the file and stopped the agent before any code ran, but it could not determine how the file arrived. AGENTS.md is the kind of instructions file that an AI coding agent reads when it starts in a folder and follows as directions; in this case it was dressed as routine engineering notes and instructed the agent to add a server to its configuration and to install an npm package named function-color.
The package, the downloader, and the MALFEX label
The package named in the instructions is part of a campaign other researchers have documented. Forever Security described function-color as pulling in a downloader called function-flag that fetches and runs a Windows payload. Researchers at CloudSEK and Checkmarx analyzed this campaign and named it MALFEX. Forever Security caught the attempt before execution on the customer's machine; the chain the file tried to create would have led from a seemingly innocuous npm package to a downloader and then to a Windows payload.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadTwo benign behaviors that make the attack possible
Forever Security highlighted two ordinary behaviors that, when combined, produce the attack path. First, coding agents are designed to trust and obey an instructions file that sits in the folder they open. Second, a web page can, without a click or permission prompt, save a file directly into the browser's Downloads folder and choose its name and contents. Forever Security reproduced the second behavior with a proof-of-concept page that silently drops an AGENTS.md into Downloads when visited. The firm did not establish that a web page was how the customer acquired the file, but the two behaviors together are sufficient to let a remote page plant a file the agent will treat as orders.
Reproductions against Codex and Claude Code
To test the full path, Forever Security reproduced the attack against two agents. Against Codex, the firm ran the real attacker file inside an isolated virtual machine. The AGENTS.md told Codex to register a server in ~/.codex/config.toml and to run a command installing the package; because that config applies to every Codex session on the machine, the change would have carried forward beyond the immediate folder. Forever Security reported Codex ran the malware in more than 90% of attempts.
Against Claude Code the working attack used a planted CLAUDE.md that framed internal gateway setup and tried to make Claude write an ANTHROPIC_BASE_URL into a project settings file, .claude/settings.json. That change would point API traffic at a server controlled by the attacker and leak the session's login token — an account takeover on its own — while allowing the server to reply as if it were the model. Claude requires a person to approve writes like that and often refuses ones that look wrong; the long engineering-doc framing got the write approved about half the time, Forever said.
Forever Security’s practical, product-agnostic advice
- Do not start Codex, Claude Code, or any agent in ~/Downloads. The Downloads folder is the one location the web can write to on its own.
- Look for instruction files you did not write. A stray AGENTS.md or CLAUDE.md in Downloads or in a newly cloned repository is the whole attack; read it before letting an agent run there.
- Check the agent's config. In ~/.codex/config.toml watch for an unexpected server block or base URL; in a project's .claude/settings.json watch for an ANTHROPIC_BASE_URL or other API endpoint you did not set.
- Leave approval prompts and sandboxes on, and be wary of anything telling the agent to switch them off.
- If you find a planted file, assume the login token leaked and rotate it. A stolen token is a live session, not just a single caught request.
What this means for technologists, procurement teams, and end users
- Technologists and security teams: audit agent start locations and CI workflows; check ~/.codex/config.toml and .claude/settings.json for unexpected server endpoints or base URLs, and keep sandboxes and approval prompts enabled.
- Procurement and enterprise IT: require deployment guidance that forbids starting agents in browser-writable locations such as Downloads, and include token-rotation procedures when a planted file is discovered.
- End users and developers: treat an unexpected AGENTS.md or CLAUDE.md as hostile content, read it before running an agent in that folder, and rotate credentials if you find one.
Forever Security framed the problem as an attack that exploits normal behavior rather than a bug in the agents themselves. "There is nothing here for OpenAI or Anthropic to patch," the company said, comparing the situation to a browser rendering a phishing page while the browser functions as designed. The firm's telemetry — roughly half of customers running agents from Downloads and a quarter of sessions opening a browser — shows the conditions are common enough to make the simple, stated mitigations immediately relevant.
The customer case leaves an open, material question: how did the AGENTS.md arrive in the Downloads folder? Forever Security could not determine that, and its proof-of-concept shows the route is plausible. The fix it recommends is likewise simple and procedural — avoid starting agents in Downloads, inspect instructions files and configs, keep prompts on, and rotate tokens — but it depends on operational discipline rather than a software patch.