BleepingComputer reported on October 25 that a malicious AGENTS.md file in a customer’s Downloads folder prompted an AI coding agent to attempt a malware installation. Forever Security said it blocked the attempt before code ran; separate tests demonstrated risks to OpenAI Codex and Claude Code.

In its October 22 research, Forever traced the attempted installation of the malicious npm package function-color to instructions disguised as engineering guidance. Such files provide project instructions that coding agents read when working in a folder.

Forever said its Codex demonstration altered global configuration to register an attacker-controlled tool server, allowing execution in later sessions. A separate CLAUDE.md demonstration redirected Claude Code API traffic to a researcher-controlled server, exposing an OAuth token and enabling malicious tool responses.

BleepingComputer verified that a demonstration webpage downloaded a harmless instruction file. It reported that browser behavior varied: Brave requested approval, while Chrome, Edge and Firefox normally show download notifications. The attack also requires the agent to load the file from its working directory; researchers could not establish how the customer’s file arrived.

Forever described the mechanism as abuse of trusted instructions rather than a conventional software flaw. Its laboratory demonstrations establish possible code execution and account takeover, but do not establish the scale of successful attacks against customers.

The researchers recommend keeping agents out of Downloads, reviewing unfamiliar instruction files and checking configuration for unexpected servers or API destinations. They advise retaining sandbox and approval controls and rotating potentially exposed tokens if suspicious changes are found.