Hidden instruction file in Downloads can trick AI coding agents into delivering malware

A website can, without the user's involvement, drop a text file into the Downloads folder and thereby get an AI coding agent to do things the user never asked for. That is according to Gal Weizman and Omer Samet, researchers at the security firm Forever Security.

According to Forever, the firm found real malware on a customer's machine that tried to exploit exactly this kind of file.

How the attack works

Coding agents such as Codex and Claude Code are AI programs that can write and run code for a developer. They automatically load instruction files such as AGENTS.md from the folder they are launched in, and follow the instructions in them.

The attack combines two things: a website can place a file in the Downloads folder, and agents trust instruction files in the folder they work in. If someone starts an agent in Downloads, it reads the attacker's file.

According to a blogger on DEV Community who recounts Forever's findings, the file in the researchers' demonstration is designed as a document with "Engineering Work Guidelines." It gets the agent to install a malicious npm package (a code package from a widely used developer library) or reroute its traffic to a server controlled by the attacker.

Forever's test results

Against OpenAI Codex, the attack succeeded in more than 90 percent of attempts, according to Forever's own tests. The agent installed the package "function-color" and modified the file ~/.codex/config.toml, so the change persists across sessions.

Against Claude Code, a variant succeeded in roughly half of attempts, according to Forever. In that case, traffic to the AI service was redirected to a domain under the attacker's control. That could leak OAuth tokens, meaning access keys to accounts, and let the attacker run code through fake responses from the model. A method in which a subagent checks in the same session worked in roughly one in five attempts against Claude Code.

Forever lists "function-color" as a sign that a machine has been compromised in this campaign.

What can you do?

Forever does not believe the providers can patch the problem, because the agents are simply doing what they are designed to do. The firm recommends:

- Never start agents in the Downloads folder. - Review unfamiliar instruction files. - Monitor configuration files. - Keep approval requirements and sandboxes (isolated environments) in place. - Change credentials if you suspect a compromise.

The blogger also recommends screening packages at installation and making sure enterprise-managed settings take precedence over project files.

Caveats

All success rates come from Forever's own tests and have not been independently verified. The number of attempts, model versions and settings has not been disclosed. It is also unclear how widespread the attack is in practice, and the sources disagree about how many people run agents from the Downloads folder. Responses from OpenAI and Anthropic are not included in the sources.