Security firm Forever Security reported on Oct. 22, 2026, that it stopped a live attempt in which a plain-text AGENTS.md file in a customer’s Downloads folder steered an AI coding agent toward installing the malicious npm package function-color. Forever said it did not know how the file reached that machine.
How the attack path works
Instruction files such as AGENTS.md and CLAUDE.md are designed to give coding agents project context. OpenAI’s Codex documentation describes AGENTS.md files for global and repository-level instructions. Anthropic’s Claude documentation describes CLAUDE.md as project memory. GitHub’s Copilot documentation also lists agent instruction files such as AGENTS.md, CLAUDE.md, and GEMINI.md for supported surfaces.
Forever’s scenario combines two ordinary behaviors. Depending on browser settings, a web page can trigger a download that lands in the default Downloads folder without asking the user to choose a location. A terminal coding agent launched from that folder may then read the file as project guidance. In Forever’s Codex test, the folder also had to be trusted. If the text persuades the agent to install a package or rewrite configuration, the agent can carry out the instruction with its available permissions.
BleepingComputer later verified a harmless proof-of-concept download and reported that Chrome, Edge, and Firefox commonly save downloaded files to the Downloads folder without asking for a location, while still showing download notifications. Brave prompted approval in BleepingComputer’s test.
BleepingComputer reported that the attack still needs a second step: the target must run the agent from Downloads after the file lands there. The research does not show arbitrary remote code execution simply by visiting a website.
What Forever reported in Codex and Claude Code
Forever said the customer file targeted OpenAI Codex. The AGENTS.md looked like a normal engineering guidelines document, with malicious setup instructions buried near the end. In Forever’s analysis, the file persuaded Codex to add a tool-server entry to the user-level ~/.codex/config.toml configuration and install function-color from npm.
Forever reported a success rate above 90% for the Codex attack. Its method note says most tests used a harmless stand-in, while the real malicious package was run once in an isolated virtual machine. Because the edited configuration applies across the same user’s projects, it could affect later Codex sessions outside Downloads.
The Claude Code demonstration used a different route. Forever said a planted CLAUDE.md could persuade Claude Code to write a local .claude/settings.json file that redirected the agent’s API traffic to a researcher-controlled server. That exposed the OAuth login token and let the server answer as though it were the model. Forever said Claude Code was harder to fool: the configuration write needed human approval and succeeded about half the time. Same-session code execution occurred about one-fifth of the time.
This report does not prove that every coding agent is equally exposed, and it does not remove the value of instruction files. Project guidance is one reason these tools work well on real codebases.
The npm package was already known as malicious
The Open Source Vulnerabilities database now lists function-color as malicious code affecting npm versions 1.0.0 and 1.7.3, and advises treating any computer with the package installed or running as fully compromised. Forever’s report says npm has since removed the package.
Checkmarx linked function-color to MALFEX, a long-running npm supply-chain campaign that it said used multiple packages to deliver Windows malware paths including a remote access trojan, an information stealer, and a downloader hidden inside function-flag. Checkmarx reported on Oct. 5 that function-color acts as a wrapper that installs function-flag.
Why security teams should treat these files differently
Plain text project instructions have usually been reviewed like documentation. Coding agents change that assumption. A README can influence a person; an AGENTS.md or CLAUDE.md can influence an autonomous tool that may have shell access, package-manager access, repository access, cloud credentials, or local tokens.
Cloud Security Alliance’s AI Safety Initiative published a related Oct. 27 note describing instruction-file poisoning as a class of risk across AGENTS.md, CLAUDE.md, Cursor rules, GitHub Copilot instructions, and other agent context files. The group recommended treating instruction and agent settings files like code, including review, scanning, change control, and stronger enforcement outside Markdown.
Practical checks for teams using coding agents
Agent instruction and settings files need ownership, review, monitoring, and least-privilege controls. For managed IT providers and small software teams, that means adding AGENTS.md, CLAUDE.md, and agent settings directories to the same checklist already used for scripts, CI configuration, package manifests, and secrets.
Do not launch agents from ~/Downloads, desktop folders, home directories, or broad parent directories. Start them in the project directory they are meant to work on.
Search endpoints and repositories for unfamiliar AGENTS.md, CLAUDE.md, GEMINI.md, .cursor/rules, .github/copilot-instructions.md, .claude, .mcp.json, .gemini, and .vscode/tasks.json files.
Review any instruction that adds Model Context Protocol or tool servers, changes API base URLs, disables approvals, bypasses a sandbox, installs packages, or asks the agent to hide setup work.
Keep approval prompts and sandboxing enabled. Treat requests to turn them off as suspicious, especially when they appear in project instructions.
Put agent instruction and settings files under code-owner review. Scan for zero-width or bidirectional Unicode characters so hidden instructions do not pass through pull requests unseen.
If function-color or another known-malicious package was installed, isolate the host and rotate secrets from a separate trusted machine.
Get new small business insights by email
Practical ideas and useful articles to help you make better business decisions.
Tech Help Canada Staff researches, writes, and reviews practical content for business owners and professionals. Our coverage spans business, marketing, SEO, technology, and the tools and systems people use to grow and operate online. We focus on clear, useful information backed by research, hands-on experience, and editorial review. Learn more about our team and editorial standards. Need help with something? Contact Us
