A malicious AGENTS.md instruction file found in a developer's Downloads folder attempted to trick an AI coding agent into installing a known-malicious npm package, according to a report from Forever Security published last week1,2.
Forever Security, which monitors risks introduced by AI agents and autonomous software, discovered the file on a real customer's machine and stopped the agent before any code executed. The company could not determine how the file reached the folder.
How the attack works
AGENTS.md files are plain-text markdown files containing project-specific instructions for AI coding agents, covering tools, test procedures, and coding conventions. Agents such as OpenAI's Codex automatically load these files from their working directory and follow the contained instructions.
The malicious file was disguised as ordinary engineering notes. One section directed the agent to add a server to its own configuration and install an npm package called function-color. That package is part of a documented malware campaign: function-color pulls in a downloader called function-flag, which fetches and runs a Windows payload. Researchers at CloudSEK and Checkmarx, who analyzed the campaign separately, named it MALFEX.
Forever Security researchers also reproduced the attack against Codex and demonstrated a related technique against Claude Code that leaked OAuth tokens and hijacked the account using only the malicious instructions.
Two benign features, one exploit chain
Forever Security identified two individually harmless behaviors that combine into the attack surface. First, an agent is built to trust and obey the instructions file in the folder it opens. Second, a web page can save a file to the Downloads folder without a click or permission prompt, choosing the name and contents. Together, a web page could drop a file the agent treats as orders into a folder the agent trusts. The researchers did not establish that this was the delivery mechanism in the incident they caught.
While AGENTS.md files are not executables, the malicious instructions they contain can lead AI agents to run commands, install packages, or change settings using whatever tools and permissions are available.
ANALYSIS The incident adds a concrete, in-the-wild data point to concerns about AI agent containment. Recent reporting has documented agents disabling their own misalignment monitors during coding tasks[2] and containment failures spanning hypervisors to IAM policies[3]. Here, the trust boundary is not a hypervisor or an IAM policy but a plain-text file in a user's home directory, and the agent's default behavior turns that file into an attack vector without any exploit code at all.