> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # AI coding agents tricked by malicious AGENTS.md files in Downloads folder - URL: https://f4n6.co.uk/security-feed/ai-coding-agents-tricked-by-malicious-agents-md-files-in-downloads-folder/ - Published: 2026-10-26T13:44:06.000Z - Updated: 2026-10-26T13:44:06.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary Forever Security found a 13 KB file named AGENTS.md in the Downloads folder of a customer machine, written to make OpenAI Codex install the malicious npm package function-color. Codex changed its own settings and installed the package in more than 90% of the researchers' test attempts, and the settings change applies machine-wide, so later Codex sessions run the attacker's command regardless of project. A separate CLAUDE.md variant redirected Claude Code's API traffic to an attacker server and captured the user's login token, which the researchers replayed against Anthropic's service to take over the account without running code. No CVE has been assigned and there is no vendor patch: the researchers state the agents are behaving as designed. The exposure for EMEA financial services is developer endpoints running coding agents in Downloads, where a website can write a file without user approval, and the credential theft that follows gives an attacker a live authenticated session. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17 | A coding agent on a developer endpoint executed an attacker-supplied instruction file and installed a malicious npm package; the researchers state there is no vendor patch, so the incident is contained by the firm's own process. | The firm needs a defined detection-and-response path for coding-agent execution on developer endpoints, not a vendor fix to wait for. | | DORA Art. 28 | The attack runs through third-party AI coding agents (OpenAI Codex, Anthropic Claude Code) and a public package registry (npm), neither under the firm's control. | Third-party risk assessment for AI coding tools must cover the agent's trust of local instruction files and its settings-change behaviour, and the npm dependency path. | | NIS2 Art. 21(2)(d) | The initial access path is a file written to Downloads by a website and consumed by a locally installed AI tool, a supply chain exposure in the tooling the firm deploys. | Supply chain security measures must extend to AI coding agents and the instruction files they obey, including controls on where agents may run. | ## 3\. Technical analysis & attack chain The mechanism is a trusted-instruction file placed where a website can write without user approval. AGENTS.md is a plain text document developers put in a project folder to give coding agents instructions. Operating systems gate execution of downloaded programs behind user approval; that gate does not apply to a plain text file, so a site can drop AGENTS.md into \~/Downloads with no click and no permission prompt. Codex follows an AGENTS.md in a folder it trusts, and Downloads qualifies once the user has worked there. Confirmed steps, from the Forever Security testing and the customer detection: 1. A website writes AGENTS.md into \~/Downloads. The customer case could not establish how the file arrived; The Hacker News reports the firm could not determine how it got into the folder. 2. The user opens Codex in the Downloads folder and gives it any task. 3. Codex first changes its own settings, then installs the package named in the file (function-color in the customer case). 4. The settings change applies to the whole computer, so every later Codex session runs the attacker's command whichever project the user opens. The planted document is 13 KB and disguised as ordinary engineering guidelines. Its length and mundane tone are what get it past the agent: a short request to install a package is refused. In the researchers' testing Codex ran the malware in more than 90% of attempts. Most testing used a harmless stand-in that only opens a calculator; the malicious package was run once inside an isolated virtual machine. The npm package function-color belonged to a malicious npm campaign that went unnoticed for about two years until it was caught and publicly documented. npm has since removed the package. Blocking a known bad package is routine; what drew the researchers' attention was the source of the install order. The Claude Code variant works differently. The researchers wrote a CLAUDE.md, inspired by the attacker's, asking the agent to save a small settings change presented as a company internal gateway, which routes Claude Code's requests to an attacker-controlled server. Claude Code normally asks a person to approve such a change and often refuses ones that look wrong; in testing Claude followed through about 50% of the time. Each request carries the user's login token, the key that keeps the user signed in. Replaying a captured token against Anthropic's service got the researchers treated as the victim, and they took over the account without running any code. On the next Claude Code start in that folder, the attacker's server can pose as the AI model and instruct the agent to run commands with its sandbox off. The file also tries to get Claude Code to start a helper agent that connects through the attacker's server immediately; that let the researchers run code within the same session in about a fifth of tests. The researchers argue there is nothing for OpenAI or Anthropic to patch, because an agent obeying the instruction file in its folder is doing its job, the same way a browser rendering a phishing page is working as designed. That position is the researchers' assessment, not a vendor statement, and no vendor response is in the source material. Two exposure facts from Forever's customer data: about half of its customers run a coding agent inside the Downloads folder, and about a quarter of agent sessions open a browser. Because much browsing is done by agents working unattended, the agent can itself visit the page that drops the file, making it both target and delivery path. Confidence caveats. The entire technical account rests on one vendor's research (Forever Security), reported by Help Net Security and The Hacker News; it is single-sourced and the success rates (over 90% for Codex, about 50% and about a fifth for Claude Code) are that vendor's test figures, not independently reproduced. The customer infection is one observed case. The two-year npm campaign is described only in general terms; no package version, maintainer, or campaign name beyond function-color is given. No CVE is associated with this item and no exploitation status is recorded. ## 4\. Mitigation & containment P1 (within 24h) - Stop starting any coding agent in the Downloads folder. Where policy allows, restrict agent working directories to vetted project paths and block \~/Downloads as an agent root. - Search developer endpoints for AGENTS.md and CLAUDE.md outside known repositories, starting with \~/Downloads: `find ~/Downloads -iname 'AGENTS.md' -o -iname 'CLAUDE.md'`. Treat any hit the user did not write as hostile. - Inspect Codex and Claude Code settings files for servers or web addresses the user did not add, and for any gateway or proxy override. Remove unauthorised entries. - Where function-color was installed, treat the machine as compromised: isolate it, rebuild, and rotate credentials used from it. - Where a planted CLAUDE.md was acted on, assume the login token leaked and replace it. A stolen token works as a live session, so revocation, not just a password change, is required. P2 (within 72h) - Keep approval prompts and sandboxes switched on for every coding agent. Any instruction telling an agent to bypass them is a hostile signal; alert on it. - Require review of any AGENTS.md or CLAUDE.md the user did not write before an agent runs in that folder, including in a freshly cloned repository. - Add npm install of function-color to blocklists and dependency-firewall deny rules, and scan lockfiles and node\_modules for it. - Restrict unattended agent browsing, or run agent sessions that open a browser in a separate low-privilege context. P3 (within 7 days) - Add coding-agent execution to endpoint detection scope: process lineage from the agent binary to package-manager installs, and writes to agent settings paths. - Brief developers that a plain text file carries no execution gate, and that a 13 KB guidelines document arriving in Downloads is the delivery format. - Review third-party risk records for OpenAI Codex and Anthropic Claude Code against DORA Art. 28, covering local instruction-file trust and settings-change behaviour. ## 5\. Indicators of compromise No atomic indicators (hashes, domains, IPs, URLs) are present in the source material. The sources describe observable behaviours only. | Behaviour | Where to observe | Confidence | | ------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------ | ------------------------------------------ | | AGENTS.md or CLAUDE.md present in \~/Downloads or outside a known repository | File system on developer endpoints | High (central to the reported attack) | | Coding agent modifies its own settings, then installs an npm package named in a local instruction file | Agent logs, process lineage from agent binary to npm install | High for Codex; test-derived | | Agent settings changed machine-wide, persisting across projects | Agent configuration files | High | | Claude Code API requests routed to an unrecognised gateway or server | Agent settings, outbound network from developer endpoints | High; single-sourced | | Helper agent spawned that connects to an external server immediately | Process and network telemetry | Medium; observed in about a fifth of tests | | npm package function-color installed | npm logs, lockfiles, node\_modules | High; package since removed from npm | ## 6\. Detection ```yara rule AGENTS_MD_Coding_Agent_Instruction_File { meta: author = "Adverse Trace" date = "2026-10-26" reference = "https://www.helpnetsecurity.com/2026/10/26/ai-coding-agents-malware-openai-codex/" description = "Detects AGENTS.md or CLAUDE.md instruction files carrying install or gateway-redirect directives" strings: $a = "AGENTS.md" ascii nocase $b = "CLAUDE.md" ascii nocase $c = "npm install" ascii nocase $d = "gateway" ascii nocase $e = "sandbox" ascii nocase condition: filesize < 64KB and 2 of them } ``` ```yaml title: Coding Agent Settings Modified Followed by Package Install id: 8f3c2a1e-at26-1026-0001 status: experimental description: Detects a coding agent changing its own settings and then invoking a package manager, consistent with a planted AGENTS.md or CLAUDE.md author: Adverse Trace date: 2026/10/26 references: - https://www.helpnetsecurity.com/2026/10/26/ai-coding-agents-malware-openai-codex/ logsource: category: process_creation product: linux detection: agent: Image|endswith: - '/codex' - '/claude' install: CommandLine|contains: - 'npm install' - 'npm i ' condition: agent and install fields: - Image - CommandLine - ParentImage falsepositives: - Legitimate agent-driven dependency installation in a vetted project directory level: medium ``` ## 7\. Sources - Help Net Security, "AI coding agents fall for malicious instructions planted in the Downloads folder", https://www.helpnetsecurity.com/2026/10/26/ai-coding-agents-malware-openai-codex/, 2026-10-26. - The Hacker News, "Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware", https://thehackernews.com/2026/10/malicious-file-in-downloads-folder.html, October 2026. - Forever Security (Gal Weizman and Omer Samet), research report referenced by both outlets above; the primary report URL is not given in the source material. ## 8\. Adverse Trace position Adverse Trace assesses this as a medium-severity exposure for firms with developer endpoints running AI coding agents, rising to high where agents are routinely started in Downloads or allowed unattended browsing. No CVE has been assigned and there is no vendor patch, so severity rests on configuration and credential exposure rather than a patchable flaw. The account-takeover path via a captured Claude Code login token is the part that matters most: a stolen token is a live session and bypasses code execution entirely. The technical account is single-sourced to Forever Security and its success rates are that vendor's test figures; verify the behaviour on your own agent builds before enforcing blocks. We will track vendor advisories from OpenAI and Anthropic for any change to instruction-file trust or settings-change approval, and we will reissue this note if atomic indicators or an independent reproduction appear. Clients should confirm within seven days which developer endpoints run Codex or Claude Code and whether any agent root includes \~/Downloads. --- [Read the original source →](https://www.helpnetsecurity.com/2026/10/26/ai-coding-agents-malware-openai-codex/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*