A planted instruction file tried to get an AI coding agent to run a known-malicious npm package, before researchers stopped it.
The Hacker News reports that security firm Forever Security found a malicious AGENTS.md file planted in a developer's Downloads folder that tried to instruct an AI coding agent to add a new server to its own configuration and install a known-malicious npm package called function-color, part of a campaign researchers call MALFEX. That package pulls in a downloader, function-flag, which fetches and runs a Windows payload. Forever says it stopped the agent before any code ran and built its own proof-of-concept page to confirm that a web page can silently drop such a file into Downloads without a click or a permission prompt.
Testing other agents, Forever found that a planted CLAUDE.md file leaked Claude Code's session login token, enough on its own for account takeover, and that Codex ran the malicious package in more than 90% of its attempts. The firm argues there is nothing for OpenAI or Anthropic to patch, since each agent was simply following its normal instruction file behavior. Its advice: do not start a coding agent in a Downloads folder, and review any AGENTS.md or CLAUDE.md file you did not write before letting an agent near it.
Why it matters: agents that automatically trust instruction files in their working directory open a low-effort path straight to developer credentials and build pipelines. As enterprises adopt agentic coding tools, untrusted instruction files need to be treated as attacker-controlled input, not configuration, with the same scrutiny given to any other untrusted data reaching an agent.