A recent report by cybersecurity firm Forever Security has uncovered a new method of malware distribution targeting AI coding agents. A malicious file, disguised as a plain-text instruction document, was found in a developer’s Downloads folder, attempting to trick the agent into installing a harmful npm package. This incident highlights a significant vulnerability in AI coding environments.
How the Attack Unfolded
The malicious file, named AGENTS.md, mimicked normal engineering documentation. It aimed to manipulate coding agents like OpenAI’s Codex by instructing them to configure servers and install a malware-laden npm package named function-color. The package is part of a broader malware campaign, known as MALFEX, which other cybersecurity researchers have studied.
The attack relies on the coding agent’s inherent trust in instruction files within its working directory. Additionally, web pages can autonomously download files to a user’s Downloads folder, bypassing user consent. While the exact method of how the file arrived remains unclear, the potential for silent file drops poses a serious risk.
Experimentation and Findings
Forever Security conducted tests to confirm the feasibility of this attack. By creating a proof-of-concept webpage, they demonstrated how an AGENTS.md file could be silently downloaded into a user’s Downloads folder. Further experiments with different coding agents showed the attack’s versatility.
In tests involving OpenAI’s Codex, the file altered server configurations, leading the agent to execute malware in the majority of cases. Similarly, a variant of the attack targeted Claude Code by modifying project settings, which, under specific conditions, could result in unauthorized server communications.
Mitigation and Best Practices
While the attack leverages standard agent behavior, Forever Security emphasizes proactive measures to mitigate risks. Users are advised against starting coding agents in the Downloads folder to prevent unauthorized file execution. Additionally, reviewing instruction files and monitoring agent configuration files for unauthorized changes are crucial steps.
Organizations should ensure that approval prompts and security sandboxes are active, and any unexpected file should be treated as potentially compromising, prompting immediate action such as rotating login tokens to mitigate session hijacking risks.
Conclusion
This incident underscores the importance of vigilance in managing AI coding environments. With about half of Forever Security’s clients running coding agents in vulnerable folders, the potential for exploitation is significant. By implementing best practices and remaining alert to unauthorized changes, developers can better protect their systems from such emerging threats.
