Forever Security detects AGENTS.md on Download that tries to install the npm function-color package

The Forever Security security firm reported the detection of a commitment attempt on a client's team: a text file called AGENTS.md, placed in the Download folder, tried to instruct a programming agent to install a malicious npm package. Forever claims that he stopped the execution before code was corrected in the host and could not confirm how that file came to the Download folder. The finding unites two known vectors - instruction files that agents read when opening a folder, and the ability of web pages to cause downloads in the Download folder - in a practical attack scenario that researchers tested in a reproducible way in the laboratory.

Confirmed facts: Forever Security found on a client's team an AGENTS.md that wanted the agent to add a server of its own to its configuration and run the installation of the npm function-color package. External researchers (including CloudSEK and Checkmark) have documented that function-color is part of a campaign called MALFEX: that package brings as a dependency a download called function-flag that downloads and runs a payload for Windows. Forever reproduced the logic of the attack on at least two agents (Codex and Claude Code) and noted that he could achieve execution or exfiltration of tokens under specific conditions. In addition, the company provided internal telemetry on use practices: approximately half of its customers run an agent from Downloads and about 25% of the agent sessions open a browser, conditions that facilitate this vector.

What happened technically. Many programming agents designed to assist with code read when you start an instruction file in the project folder (in specific examples, AGENTS.md or CLAUDE.md) and run configuration or command steps. Forever used a file that, camouflaged as engineering notes, indicated to the agent to add a server input into a persistent configuration file (e.g., ~ / .codex / config.toml) and run a command to install the function-color package. By changing the overall configuration of the agent to target a server controlled by the attacker, the opponent can make future sessions of the agent consult and execute arbitrary instructions from that server. In the case of Claude Code, the proposed amendment was to write an environment variable or an adjustment (ANTHROPIC _ BASE _ URL) that redirects the agent's API communication to an attacker's endpoint; that can filter the session token and allow malicious responses that the agent assumes as valid.

How the malicious file is delivered remains uncertain. Forever highlights two conditions that make the technique feasible: an agent who trusts and obeys an instruction file in the folder he opens, and the fact that a website can start downloads to the Download folder without explicit user intervention in default configured browser environments. To demonstrate the full chain, researchers published a concept test: a website that, when visiting it, causes the silent download of an AGENTS.md on Download. This shows that the technical route works; however, Forever did not establish that this method was used to enter the file into the actual client's computer.

Real impact and consequences. If the agent runs the steps of the malicious file, the potential consequences are serious on two fronts: malicious code execution on the machine(e.g. the download that brings a payload for Windows) and commitment of credentials and session tokens which allow you to take control of the service account (what researchers describe as account takeover). In the case against Codex, Forever reported that the agent executed the code in more than 90% of the attempts; against Claude Code the rate was lower because that agent asked for confirmation for certain changes and the operation came forward in about half of the attempts when the file was written as extensive technical documentation.

What's confirmed and what's not. Confirmed: the file AGENTS.md with malicious instructions existed on the client's computer; function-color and function-flag are part of a delivery chain observed by other researchers; agents can obey local instruction files and modify persistent settings. Unconfirmed: the exact vector by which the file reached the client's team - Forever did not determine whether it was a silent download induced by a website, a cloned repository or a local insertion - and neither did a real attacker use the automatic download concept test for that specific incident.

Practical and concrete recommendations for developers and security equipment: maintain human intervention and isolation as a standard when executing agents.

Don't throw agents from ~ / Download. It is the folder that the browser can write without additional interaction in most settings; using it as an agent work directory puts the software in contact with content that may have been placed by a website.

Before allowing an agent to open a folder, inspect instruction files. Look for AGENTS.md, CLAUDE.md or any README that contains unexpected configuration steps; read them before starting the agent. A camouflaged file in a newly cloned repository is enough to win execution.

Check the agent's local settings. Check ~ / .codex / config.toml and equivalent files (.claude / settings.json or others) for server blocks or URLs API that have not explicitly added; treat any unauthorized changes as an indication of commitment and rote tokens and associated credentials.

Keep the approval tips and sandboxes on. Do not disable interactive controls that require confirmation before writing global configurations or running installation commands. If the agent asks to raise privileges or change API destinations, examine it carefully.

It assumes that an exposed token is immediately valid. If you find a planted file, roll the tokens and close sessions; a stolen token is a live session and can allow subsequent actions, even if the first request was registered and blocked.

Reduce risk from browser and operating system. Set the browser to block automatic downloads, change the default download folder to a less used location to run code and consider corporate policies that prohibit running agents in directories that the browser can manipulate. Technical documentation on the mechanics of downloads from pages can be consulted in resources such as MDN: MDN - attribute download.

Use insulation and ephemeral environments for agent testing. Run agents on virtual machines or containers with limited access to credentials and without persistent tokens, and apply network controls that prevent direct communications to unauthorized servers.

To better understand the risk of the overall package supply chain, rules and mitigation, it is useful to review the community's work on software supply chain attacks and defence standards: for example, the OWASP project on supply chain. OWASP - Supply Chain Attack. Forever Security has published the technical details of its research and concept tests; teams that manage internal agents and policies must read these reports and adjust telemetry and use guides accordingly.

The practical conclusion is that in the short term there is no single "patch" on the part of the model provider when the agent is doing exactly what was designed to do: follow local instructions. The control is the hygiene of folders, the policy of execution and the rotation of credentials. Taking these measures directly reduces the opportunity window that these malicious instructional files exploit.