{"id":3770,"date":"2026-10-26T07:58:53","date_gmt":"2026-10-26T07:58:53","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3770"},"modified":"2026-10-26T07:58:53","modified_gmt":"2026-10-26T07:58:53","slug":"malicious-file-in-downloads-folder-tries-to-trick-ai-coding-agent-into-installing-malware","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3770","title":{"rendered":"Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware"},"content":{"rendered":"
\n

\ue804<\/i>Swati Khandelwal<\/span>\ue802<\/i>Oct 26, 2026<\/span><\/span>Artificial Intelligence \/ Endpoint Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

A malicious instruction file sitting in a developer’s Downloads folder tried to make their AI coding agent install a known-malicious npm package, security firm Forever Security said in a report published last week.<\/p>\n

The company caught the attempt on a real customer’s machine and stopped the agent before any code ran. It could not determine how the file got into the folder.<\/p>\n

The file was AGENTS.md, a plain-text instructions file that a coding agent, such as OpenAI’s Codex, reads when it starts in a folder and follows as directions.<\/p>\n

It was dressed up as ordinary engineering notes. One section told the agent to add a server to its own configuration and install a package called function-color from npm.<\/p>\n

That package is part of a malware campaign that other researchers have documented separately: function-color pulls in a downloader called function-flag, which fetches and runs a Windows payload. Researchers at CloudSEK and Checkmarx, who analyzed the campaign<\/a>, named it MALFEX.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Two things, each harmless on its own, make this work, Forever said<\/a>. An agent is built to trust and obey the instructions file in the folder it opens. And a web page can save a file to the Downloads folder on its own, without a click or a permission prompt, choosing the name and contents. Put together, a web page can drop a file the agent will treat as orders into a folder the agent trusts.<\/p>\n

<\/p>\n

Researchers did not establish that this is how the file was caught. To test whether the full path was possible, it built its own proof-of-concept page: visit it, and an AGENTS.md downloads silently into Downloads. Whether a real attacker used that route against the customer is not known.<\/p>\n

The firm then reproduced the attack on two coding agents to show that it was not specific to a single product. Against Codex, it ran the real attacker file inside an isolated virtual machine. The file, framed as routine project setup, told Codex to register a server in ~\/.codex\/config.toml and run a command that installed the package.<\/p>\n