A Text File Sitting in Downloads Tried to Turn an AI Coding Agent Against Its Owner. The Attack, One Step at a Time
Security firm Forever Security found a planted AGENTS.md instruction file in a customer’s Downloads folder that told an AI coding agent to install a known-malicious package. Here is how the attack works step by step, how well it worked in tests, and the simple habits that stop it.
AI coding agents are built to be helpful, and part of being helpful is reading the notes left for them. Many agents look for a plain-text instruction file in the folder where they start, and they follow what it says. Researchers have now caught an attacker taking advantage of exactly that, using nothing more than a text file in the one folder the web can write to.
BleepingComputer first described the findings from Forever Security, a firm that monitors risks created by AI agents. The Hacker News added details on the malware and the tests.
The attack, step by step
- A file lands in Downloads. Forever found a file named AGENTS.md in a customer’s Downloads folder. It could not tell how the file got there. To show one possible route, it built a test web page that, when visited, silently saves an AGENTS.md file into Downloads. Chrome, Edge and Firefox save downloads there by default without asking where, although they do show a download notification.
- Someone starts an agent in that folder. The attack only works if a coding agent is launched with Downloads as its working folder. That is more common than it sounds, because people use agents to tidy Downloads or to work on a file they just pulled down. Forever told BleepingComputer that hundreds of its customers run agents such as Claude Code, OpenAI Codex and Cursor CLI from Downloads, and that Claude Code alone started more than 1,300 sessions there.
- The agent reads the file as orders. The planted file looked like ordinary engineering notes. One section told the agent to add a server to its own configuration and install an npm package called function-color.
- The package fetches malware. According to The Hacker News, function-color belongs to a campaign that CloudSEK and Checkmarx researchers named MALFEX. It pulls in a downloader that fetches and runs a Windows payload.
- The change follows the user everywhere. In the Codex version, the server is written into the agent’s global settings file, so it would load in every later session in any folder, not only in Downloads.
- The real attempt was stopped. On the customer’s machine, Forever’s tooling stopped the agent before any code ran.
How well it worked in testing
Forever rebuilt the attack in an isolated lab. Against Codex, using a harmless payload that only opened the calculator, it worked about 90% of the time. Against Claude Code, a planted CLAUDE.md file asked the agent to point its API traffic at a server Forever controlled. That single change would leak the session’s login token, which amounts to account takeover. Claude asks a person to approve that kind of edit and often refuses, but the long, official-sounding text got it approved roughly half the time.
Why there is no patch
Forever says there is nothing for OpenAI or Anthropic to fix, because an agent that follows the instruction file in its folder is doing what it was designed to do. The firm compares it to a browser showing a phishing page: the browser works correctly, and the danger is in the content. OpenAI and Anthropic both recommend starting an agent in the specific project folder it should work on.
Habits that stop it
- Never start a coding agent in Downloads, your home folder or another broad folder. Start it in the project it is meant to work on.
- Read any AGENTS.md, CLAUDE.md or similar instruction file you did not write before an agent uses it, including in repositories you just cloned.
- Check the agent’s settings files for servers or API addresses you did not add.
- Keep approval prompts and sandboxing switched on, and be suspicious of any instructions that tell the agent to turn them off.
- If you find a planted file, assume the agent’s login token has leaked and replace it.
What this means for your company
If anyone in your business uses AI coding agents, including a contractor or the one staff member who builds your spreadsheets and scripts, those tools can install software and change settings with that person’s access. A short written rule on where agents may run, which approvals stay on and who reviews instruction files costs nothing and closes this door. It is also a good moment to make sure developer machines have endpoint protection and that agent accounts and tokens are listed somewhere so they can be revoked quickly.
Need help setting simple, safe rules for AI coding tools on your team’s computers? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
