AI coding agents like OpenAI Codex and Anthropic Claude Code face significant security threats from malicious files placed in the Downloads folder. These files can manipulate the agents into altering configurations, installing harmful software, or exposing sensitive login tokens. The discovery was made by Forever Security during an investigation into an incident involving a customer’s computer.
Discovery of the Vulnerability
The security threat was identified by Forever Security after preventing an AI coding agent from installing a suspicious npm package named function-color. This action led investigators to trace the issue back to an AGENTS.md file located in the ~/Downloads directory of the user’s system. Although the file appeared to be standard engineering documentation, it contained instructions for the agent to modify its setup and proceed with the package installation.
The origin of the file remains unknown, but researchers demonstrated that websites could potentially deliver such files through typical browser download processes, establishing a feasible attack vector. Both OpenAI Codex and Claude Code rely on these types of instruction files—AGENTS.md and CLAUDE.md respectively—to read project rules and commands, making them vulnerable when mixed with commonly trusted download folders.
Implications of the Codex Attack
In controlled experiments, Codex frequently obeyed the malicious instructions, resulting in the addition of a rogue server to its configuration file, making the attack persistent. This server entry allowed subsequent Codex sessions to load the malicious configuration even if the user changed folders or projects. Although most tests used benign software, the malicious package was executed within a secure virtual environment.
The attack aligns with the MALFEX npm malware campaign, which has targeted developers using Windows. The function-color package was linked to function-flag, capable of downloading and executing Windows programs stealthily. The broader campaign included malware that could compromise browser, Discord, Telegram, and cryptocurrency wallet data.
Claude Code and Token Exposure
Claude Code was exploited using a different method. A malicious CLAUDE.md file was crafted to alter Claude’s configuration, rerouting API traffic to a researcher-controlled server and exposing OAuth tokens. Forever Security reported that this modification occurred in approximately half of the conducted tests. With the captured token, researchers could impersonate the victim by accessing Anthropic’s services.
These findings highlight the growing risk of software supply-chain attacks facilitated by instruction files and extensions. Prior studies have shown that malicious agent skills targeting AI tools can evade detection by automated systems.
Developers are advised to avoid launching AI coding agents within the Downloads folder and to scrutinize unknown instruction files before allowing agents to access them. It is vital to maintain approval checks, sandbox environments, and network access restrictions to prevent unauthorized actions. Security teams should regularly audit configuration files for unknown entries and revoke compromised tokens from secure devices. Keeping systems updated against emerging malware threats is crucial for maintaining cybersecurity.
