Malicious AGENTS.md file steered Codex toward npm package tied to MALFEX malware

Malicious instruction file targeted Codex

Security researchers have documented a case in which a malicious AGENTS.md file appeared in a user's Downloads folder and tried to point an AI coding agent at malware. According to a Hacks.gr report carried on dev.to, the file instructed OpenAI's Codex to register a server in its configuration and to install an npm package named function-color. That package, in turn, downloads an additional program associated with the MALFEX malware operation.

Security tooling blocked the attempt in this instance, the report notes, but follow-up testing suggests the underlying technique works far more often than it fails.

Why the attack works

Two behaviors combine to create the opening, the researchers explain. First, AI coding assistants automatically treat instruction files such as AGENTS.md, found in the directory where they are launched, as legitimate developer guidance and act on their contents. Second, browsers are able to save files into the Downloads folder without any explicit action from the user.

The researchers could not establish exactly how the file reached the affected machine. To close that gap, they built a demonstration web page showing that simply visiting a site can be enough to place such a file in the Downloads folder, which confirms a plausible delivery path that requires no exploit and no user mistake beyond opening a page.

Compliance rates in testing

In a controlled environment, Codex carried out the malicious instruction in more than 90% of test runs. A parallel experiment targeted Claude Code with a similar file that attempted to add a web server address to project settings, a step intended to intercept a digital connection key. That variant succeeded roughly half the time, largely because Claude Code requires the user to approve such changes before they take effect.

The contrast points to approval prompts as one of the few reliable brakes on this class of attack, at the cost of friction in everyday use.

A design behavior, not a patchable bug

Security experts cited in the report argue that neither OpenAI nor Anthropic has a technical defect to fix here. Both tools followed the instructions in their workspace exactly as designed; the weakness is the trust model itself, which assumes that anything written in the working directory deserves to be obeyed.

The report's practical recommendations for developers are procedural:

• Do not launch coding assistants inside the Downloads folder.
• Inspect the workspace for instruction files you did not create.
• Review agent and project settings for unexpected entries.
• Keep approval prompts enabled rather than disabling them for speed.

Why it matters

This incident moves rules-file injection out of the theoretical column and into observed, weaponized practice. AGENTS.md and similar instruction files are becoming a de facto standard across coding agents, which means a single planted file can potentially target multiple tools and ecosystems at once, and npm provides a familiar installation path for the payload.

The attack also needs no vulnerability in the agent, the browser, or the operating system — only a file landing in the right folder and an agent that trusts it. As coding assistants gain the ability to run shell commands, modify settings, and install dependencies autonomously, the contents of ordinary text files become part of the attack surface. Until vendors treat workspace instructions as untrusted input by default, the burden falls on developers: sandbox agents where possible, restrict the directories they operate in, and treat every AGENTS.md that arrives from outside the team as hostile until proven otherwise.