A planted AGENTS.md in ~/Downloads is read as project rules by agents started there; it steered Codex and Claude Code to a malicious npm package

View raw markdownEdit on GitHub ↗

TL;DR

Researchers at Forever Security showed, and BleepingComputer (10-25) and The Hacker News (10-24) reported, that a browser download can drop an instruction file into ~/Downloads, and an agent started in that folder treats it as the project's rules. Their test file told the agent to install an npm package from the MALFEX family (function-color, already in the MALFEX advisory); Codex complied in about 90% of runs and Claude Code in about 50%. The researchers' own customer telemetry showed hundreds of customers running agents from ~/Downloads and more than 1,300 Claude Code sessions launched from that folder. Both vendors told the outlets the behaviour is by design: the instruction file is trusted because the directory is. Never start an agent in a folder a browser writes to, and treat instruction files you did not write as untrusted.

What happened

An instruction file is not code, so download scanners, Gatekeeper and SmartScreen ignore it; it only has to be present when the agent reads its working directory. The researchers' chain ended at a package install, which is the step this corpus already tracks as a compromise. No vulnerability was assigned and there is nothing to patch; the control is where the agent is started and what it is allowed to install.

Am I affected?

  • ls ~/Downloads/AGENTS.md ~/Downloads/CLAUDE.md ~/Downloads/.cursorrules ~/Downloads/.github/copilot-instructions.md and the same in any folder a browser, mail client or chat app saves to.
  • Agent session logs showing a working directory under Downloads, Desktop or a shared folder.
  • npm ls -g function-color and the MALFEX package list in the linked advisory.

If you are affected

  1. Delete the planted file; if the agent ran an install from it, follow if you installed a bad npm package and if your local AI agent was exploited.
  2. Rotate what the session could read: credential hygiene.

Prevention

  • Start agents in a project directory you created; add Downloads and Desktop to the agent's deny list where the tool supports one.
  • Require confirmation for package installs and network calls; agent sandboxing.

Sources