Stealthy Malware Exploit: How a Simple Text File Can Hijack Your AI Coding Agent

The Silent Threat: How a Simple File Can Hijack Your AI Coding Agent

In an alarming revelation, security firm Forever Security has exposed a cunning new vector for malware infection, targeting the very tools designed to assist developers: AI coding agents. A seemingly innocuous instruction file, found lurking in a developer’s Downloads folder, attempted to coerce an AI agent into installing a known-malicious npm package. This sophisticated attack underscores a critical vulnerability at the intersection of developer workflows and artificial intelligence.

The Modus Operandi: A Deceptively Simple Scheme

The core of this threat lies in its elegant simplicity. The malicious file, named AGENTS.md, is a plain-text instruction document that AI coding agents like OpenAI’s Codex are programmed to read and obey upon launch within a specific directory. Disguised as routine engineering notes, this file contained a hidden directive: add a server to the agent’s configuration and install a package called function-color from npm.

This package is no stranger to the cybersecurity community. It’s a component of the MALFEX malware campaign, previously documented by researchers at CloudSEK and Checkmarx. function-color acts as a downloader, pulling in function-flag, which then fetches and executes a Windows payload, granting attackers a foothold on the compromised system.

Forever Security highlights two seemingly harmless factors that, when combined, create this potent threat:

• Agent Trust: AI coding agents are inherently designed to trust and execute instructions found in their operational folders.
• Browser Autonomy: Web browsers can silently save files to the Downloads folder without explicit user interaction or permission prompts, dictating both the filename and content.

Together, these elements allow a malicious webpage to drop a file that an AI agent will unquestioningly treat as legitimate commands, all within a trusted directory.

Proof of Concept: Replicating the Attack

While the exact method of the initial file’s placement remains unconfirmed, Forever Security successfully demonstrated the attack’s feasibility. They crafted a proof-of-concept webpage that, upon visitation, silently downloads an AGENTS.md file into the Downloads folder.

Further testing involved replicating the attack on two prominent coding agents:

• OpenAI Codex: Running the attacker’s file in an isolated virtual machine, Codex was instructed to register a server in ~/.codex/config.toml and install the malicious package. This configuration change would persist across all Codex sessions on the machine, not just the Downloads folder. Forever Security reported a chilling success rate of over 90% for malware installation.
• Anthropic Claude Code: A different approach was used here, involving a planted CLAUDE.md file. This file, framed as internal gateway setup, attempted to make Claude write an ANTHROPIC_BASE_URL into a project settings file, redirecting its API traffic to a server controlled by Forever. This single change could leak the session’s login token, leading to immediate account takeover. Although Claude requires human approval for such writes and often flags suspicious requests, the elaborate engineering-doc framing managed to secure approval approximately half the time.

The “No Patch” Paradox: A Design Feature, Not a Flaw

Intriguingly, Forever Security asserts that there’s nothing for OpenAI or Anthropic to “patch.” The agents, in their view, are simply performing as designed by following instructions within their designated folders. They draw a parallel to a web browser rendering a phishing page: the browser functions correctly, but the attack lies in the malicious content it processes.

“There is nothing here for OpenAI or Anthropic to patch,” Forever emphasized, highlighting that the vulnerability stems from the interaction model, not a software defect.

Protecting Your AI: Essential Safeguards for Developers

Given that the onus of protection falls largely on the user, Forever Security offers practical, product-agnostic advice:

• Avoid Downloads Folder for Agents: Never initiate Codex, Claude Code, or any AI agent in your ~/Downloads directory. This is the primary folder where web content can be written autonomously.
• Scrutinize Instruction Files: Be vigilant for unexpected instruction files like AGENTS.md or CLAUDE.md, whether in your Downloads folder or a newly cloned repository. Always read these files thoroughly before allowing an agent to interact with them.
• Monitor Agent Configurations: Regularly check your agent’s configuration files. For Codex, inspect ~/.codex/config.toml for any unauthorized server blocks or altered base URLs. For Claude, review .claude/settings.json for unfamiliar ANTHROPIC_BASE_URL or other API endpoints.
• Maintain Approval Prompts and Sandboxes: Keep all approval prompts and sandbox features enabled. Be extremely cautious of any instruction that attempts to disable these critical security measures.
• Rotate Tokens if Compromised: If you discover a planted file, assume your login token has been leaked and rotate it immediately. A stolen token represents a live session, not merely a captured request.

Forever Security’s telemetry reveals a concerning trend: roughly half of their customers run coding agents in their Downloads folder, and about a quarter of agent sessions involve browsing. These statistics paint a clear picture of the fertile ground attackers have for exploiting this vulnerability, often without any human oversight during the file drop.

The rise of AI coding agents brings unprecedented productivity, but also new attack surfaces. Vigilance and adherence to best security practices are paramount to safeguarding your development environment against these evolving threats.

For more details, visit our website.

Source: Link