MALFEX: AI coding agents (Codex, Claude Code) — planted AGENTS.md in Downloads tricks agent into installing malicious npm package
Severity: high · Patch status: no-fix-needed · Since 2026-10-26
Forever Security reported catching a real attempt in which a malicious AGENTS.md instructions file, silently placed in a developer's Downloads folder, tried to make an AI coding agent install the known-malicious npm package function-color (part of the MALFEX campaign, which pulls a downloader function-flag that fetches and runs a Windows payload). The attack combines two behaviors: agents trust instruction files in the folder they open, and websites can write files to Downloads without prompts. Against Codex, the file registered an attacker server in ~/.codex/config.toml and ran in over 90% of attempts; against Claude Code, a planted CLAUDE.md got an ANTHROPICBASEURL write approved about half the time, leaking the session token. No vendor patch applies; mitigation is behavioral. Roughly half of Forever's customers run agents in Downloads.
What to do
- Do not start Codex, Claude Code, or any coding agent in ~/Downloads
- Check for instruction files you did not write (AGENTS.md, CLAUDE.md) in Downloads or freshly cloned repos and read them before letting an agent run
- Inspect ~/.codex/config.toml for unknown server blocks and .claude/settings.json for unknown ANTHROPIC_BASE_URL entries
- Keep approval prompts and sandboxes enabled; distrust instructions that ask to disable them
- If a planted file is found, assume the login/API token leaked and rotate it
Sources
All live incidents on Threat Watch