Fake Instructions File in Downloads Folder Tried to Make an AI Coding Agent Install Malware

Security firm Forever Security reported that a malicious instruction file in a developer's Downloads folder tried to push an AI coding agent into installing malware. The file was named AGENTS.md, a plain-text file that coding agents such as OpenAI's Codex read and follow when they start in a folder. It was disguised as ordinary engineering notes and told the agent to add a server to its own configuration and install an npm package called function-color. That package belongs to a malware campaign, named MALFEX by researchers at CloudSEK and Checkmarx, which pulls in a downloader that fetches and runs a Windows payload. Forever stopped the agent before any code ran, but could not determine how the file reached the folder.

Forever says two harmless-looking behaviours combine to create the risk. Agents are built to trust the instructions file in the folder they open, and a web page can save a file to Downloads without a click or permission prompt, choosing its name and contents. The firm built its own proof-of-concept page to show this path is possible, though it does not know whether a real attacker used that route against the customer.

Forever also reproduced the attack on two coding agents. Against Codex, it ran the real attacker file in an isolated virtual machine. The file told Codex to register a server in its configuration file and run the install command. Because that configuration applies to every Codex session on the machine, the change would load the attacker's server in any folder afterwards. Codex ran the malware in more than 90% of attempts, Forever said.