Security firm Forever Security demonstrated that a planted CLAUDE.md file could successfully convince an agent to leak sensitive session tokens about fifty percent of the time. This novel attack vector exploits the inherent trust that AI coding agents place in local instruction files, such as those with markdown extensions intended for project configuration. In a recent incident, a developer discovered a malicious AGENTS.md file within their Downloads directory, a location frequently accessed by automated tools during routine workflows. The file was ingeniously disguised as standard engineering documentation, yet it contained hidden instructions designed to manipulate the agent’s internal logic. Specifically, the file directed the agent to modify its own configuration and install a compromised npm package from the MALFEX campaign. This campaign is known for deploying a downloader that executes payloads on Windows systems. Because these agents are designed to follow local documentation to streamline setup, they often execute these commands without surfacing any warnings.
1. The Anatomy of Silent Persistence: Exploiting Local Trust
The technical execution of this exploit relies on two seemingly benign browser and agent behaviors that, when combined, create a significant security loophole. Modern web browsers can sometimes be manipulated to download files into a user’s local directory without an explicit confirmation prompt, a technique often referred to as a drive-by download. When a developer visits a compromised website, a file like AGENTS.md can be silently placed into the Downloads folder. Simultaneously, AI coding agents like OpenAI’s Codex or Anthropic’s Claude Code are programmed to scan the current working directory for configuration files to understand the context of the code they are assisting with. Since these agents treat local files as authoritative sources of truth provided by the developer, they consume the malicious instructions as if they were legitimate project requirements. This relationship creates a bridge between a malicious external web entity and the internal administrative capabilities of the developer’s local machine.
Central to the observed threat is the integration of the MALFEX malware campaign, which utilizes deceptive npm packages to compromise development environments. The malicious instruction file explicitly tells the agent to install a package named function-color. While the package name sounds like a helpful utility, it actually serves as a stage-one downloader for a more intrusive payload known as function-flag. Once executed, this second-stage component fetches and runs a binary specifically tailored for Windows environments, allowing attackers to gain a foothold on the developer’s system. Researchers from CloudSEK and Checkmarx have been tracking this campaign, noting its increasing sophistication in targeting software supply chains. By leveraging an AI agent to perform the installation, the attackers bypass the need for a human to type the installation command, reducing the chance of manual scrutiny. The agent effectively becomes a proxy for the attacker, using its permissions to pull malware directly into the most sensitive areas.
2. Differential Vulnerabilities and Strategic Defense
To evaluate the breadth of this risk, security experts conducted controlled experiments against various popular AI coding platforms, uncovering distinct behaviors in how they handled malicious files. When testing against OpenAI’s Codex, researchers utilized a real attacker-generated file within an isolated virtual machine to prevent actual system damage. The file, masquerading as a routine project setup guide, instructed Codex to register a new server within the global configuration file located at ~/.codex/config.toml. Because this configuration file is persistent and applies to every subsequent session the agent initiates, the modification effectively permanentized the attacker’s access across all future projects. The success rate for this particular attack was alarmingly high, with Codex executing the malicious instructions in over ninety percent of the attempts. This high success rate highlighted a fundamental design philosophy where the agent prioritized automation and efficiency over verification, making it an effective tool for attackers seeking persistence.
The findings from these security assessments revealed a fundamental shift in the threat landscape, where the tools designed to increase productivity became the primary vehicles for compromise. Security teams recognized that the primary vulnerability was not a flaw in the AI models themselves, but rather the unrestricted access these agents had to untrusted directories. To address these emerging threats, organizations adopted stricter operational protocols for the use of AI assistants. Developers were instructed to never initialize a coding agent within a Downloads folder, as this remained the most vulnerable point for drive-by file placement. Furthermore, mandatory audits of configuration files like config.toml and settings.json became a standard part of the development lifecycle to ensure no unauthorized API endpoints were introduced. The industry also moved toward more robust sandboxing environments, ensuring that agents operated within restricted permissions that prevented them from making persistent changes without multi-factor verification.