Malicious Downloads Can Hijack AI Coding Agents, Forever Security Finds

What happened

Malicious instruction files placed in a computer's Downloads folder can manipulate AI coding agents into running harmful code or exposing authentication tokens, according to research published by the security firm Forever Security. The firm said it blocked an attempted attack on a customer's machine and reproduced similar techniques against OpenAI's Codex and Anthropic's Claude Code.

In the case the firm investigated, it found a malicious AGENTS.md file in a customer's Downloads folder. The file instructed Codex to install an npm package named function-color, which the firm identified as malicious. The installation was stopped before the malware could run. The researchers could not establish how the file reached the computer in the first place.

The team also showed that a malicious website could trigger a similar download without a separate approval prompt, which widens the potential route of attack beyond local files. The technique works because coding assistants read project-specific instructions. Codex uses AGENTS.md files, while Claude Code supports CLAUDE.md files, and both tools can act on instructions written in these Markdown documents when they operate in a project.

Why it matters

AI coding agents are moving from suggesting code to taking actions: installing packages, running commands and handling credentials. This research shows that the instructions these agents follow can come from places users do not think of as command channels, such as a downloaded document. For organisations adopting agentic tools, the question shifts from whether the model is accurate to what the agent is permitted to do, and who or what has been allowed to instruct it.

For digital transformation leaders, the finding points to a governance gap. Developer tools are often adopted quickly, with permissions granted by default. Where agents can act on behalf of staff, their configuration files, dependencies and download paths become part of the attack surface and should be managed with the same discipline as any other production system.

The Renascence take

Most coverage of this story will focus on the malware. The more useful lesson is about trust boundaries. A helpful assistant that obeys project instructions is only as safe as the least-examined file it reads, and people rarely review a downloaded Markdown file as if it were an instruction set.

The real failure is not a bad package; it is an approval model that lets a document carry the authority of a manager. Behavioural economics would predict exactly this: people and tools default to trust once a workflow feels routine, and friction only appears after something goes wrong. Customer-obsessed operators should treat agent instruction files as untrusted input, require explicit approval for installs and network actions, and audit which folders and tokens an agent can reach. Design the agent's permissions as carefully as you would design a customer journey, because the moment an agent acts without a checkpoint, the experience you are responsible for is no longer the one you designed.