New attack tricks AI coding agents into installing malware: how the AGENTS.md trick works
A planted AGENTS.md file in your Downloads folder can steer AI coding agents like Codex into installing a malicious npm package. Here's how the attack works and seven ways developers can stay safe.
AI coding agents like OpenAI’s Codex and Anthropic’s Claude Code can write code, run commands and install packages for you. That makes them powerful, and, as a new report shows, it also makes them a target.
Security firm Forever Security found a malicious AGENTS.md file sitting in a real developer’s Downloads folder. The file tried to make an AI agent install a known-malicious npm package. Forever caught it and stopped the agent before any harmful code ran.
What is AGENTS.md?
AGENTS.md (and CLAUDE.md for Claude Code) are instruction files. When you open an AI agent in a folder, it reads these files to learn about the project, such as how to build it, test it and which style to use. The agents are designed to trust and follow these instructions.
That’s the weakness: if an attacker can place one of these files where your agent runs, the agent may follow the attacker’s instructions.
How the attack works
- A web page silently saves an AGENTS.md file into your Downloads folder. Browsers can do this without a click or a warning.
- Later, you start an AI coding agent in the Downloads folder, for example to look at a file you just downloaded.
- The agent reads the planted file and follows its instructions.
- In the real case, the file told the agent to install
function-color, a package from the MALFEX npm malware campaign. It pulls in a downloader that fetches and runs a Windows payload.
Forever built a proof-of-concept page to show step 1 is possible, but it couldn’t confirm how the file reached the real victim’s machine.
How well did it work?
- Codex: in an isolated test machine, a planted file led Codex to change its settings file (
~/.codex/config.toml) and install the package in over 90% of attempts. That settings change affects every future session. - Claude Code: a planted CLAUDE.md tried to redirect API traffic by changing
ANTHROPIC_BASE_URL, which could leak the login token. It worked about half the time, because Claude often refused suspicious changes.
Forever’s data also suggests about half of its customers run a coding agent in their Downloads folder at some point.
“There is nothing here for OpenAI or Anthropic to patch,” Forever said. The agents did what they were designed to do: follow instructions. The fix is in how we use them.
7 ways to protect yourself
- Never run a coding agent in your Downloads folder. Move files into a project folder first.
- Read unfamiliar AGENTS.md or CLAUDE.md files before starting an agent in a folder you didn’t create, including cloned repos.
- Keep approval prompts on. Don’t let agents install packages or change settings without asking.
- Use sandboxes or containers for agents, especially when working with untrusted code.
- Check agent config files (such as
~/.codex/config.tomland Claude Code settings) for unknown servers or base URLs. - Rotate your API tokens if you ever find a planted instruction file.
- Use package security tools that warn about known-malicious npm packages before install.
Why it matters
This is part of a bigger trend: attackers are learning to target the tools developers trust. It follows a busy month for security, including the PHP flaws, the Railway breach and the ConnectWise hack. Read our roundup: The week the internet had a security crisis.
Frequently asked questions
What is an AGENTS.md attack?
It’s when an attacker plants an instruction file that an AI coding agent reads and follows, tricking it into doing something harmful, such as installing malware.
Are Codex and Claude Code unsafe?
They’re not “broken”, but they follow instructions in project files. Use them in trusted folders with approval prompts and sandboxes turned on.
Has this attack hurt anyone?
In the case Forever reported, the attempt was caught and stopped before any code ran.
Will OpenAI or Anthropic fix this?
Forever says there’s nothing to patch, because the agents behaved as designed. Safer usage habits are the main protection.
