AI coding agents tricked by malicious AGENTS.md file in Downloads folder

Researchers at Forever Security identified a malicious AGENTS.md file in a customer's Downloads folder that instructed an AI coding agent to install a rogue npm package named function-color. The company detected the attempt on a real customer's machine and stopped the agent before any code executed. The function-color package is part of a malware campaign called MALFEX that pulls in a downloader named function-flag. The researchers could not determine how the file landed in the target's Downloads location, but noted that simply visiting a malicious page could drop a payload there without user interaction.

BleepingComputer tests showed that Chrome, Edge, and Firefox save web-downloaded files to the ~/Downloads directory without prompting users to choose a location. The attack requires the target to launch their AI agent in the same directory as the malicious file. Internal statistics indicate hundreds of customers run AI agents from their Downloads folders, with Claude Code alone launching more than 1,300 sessions from that location. Tests against OpenAI Codex using a harmless payload showed a 90% success rate, while a test using a malicious CLAUDE.md file to redirect Claude Code's API traffic succeeded in roughly 50% of tests.

OpenAI and Anthropic recommend running AI coding agents from the project directory they are intended to work on. The researchers created a proof-of-concept page that downloaded an AGENTS.md file containing harmless content to demonstrate the vulnerability.