The Silent Hijack: How AI Coding Agents Are Being Weaponized Through Your Downloads Folder

By Swati Khandelwal
October 26, 2026

In an era where Artificial Intelligence has become the cornerstone of modern software development, a new and insidious threat vector has emerged. Security researchers at Forever Security have uncovered a sophisticated attack methodology that weaponizes the very tools designed to boost developer productivity: AI coding agents. By manipulating the "instructions" files that these agents rely on to understand project context, attackers are successfully tricking autonomous systems into installing malicious software, potentially compromising entire development environments.

The Mechanics of the Attack: Trust as a Vulnerability

The attack, which was first identified on the machine of a real-world customer, hinges on a dangerous intersection between web browser behavior and the operational architecture of AI coding agents.

Most AI coding agents—such as OpenAI’s Codex or Anthropic’s Claude Code—are designed to be context-aware. Upon being launched within a specific directory, these agents automatically scan for configuration or instruction files. These files, often named AGENTS.md or similar, provide the agent with a set of "ground rules" for how to behave, which libraries to prioritize, and how to structure the project.

Forever Security’s investigation revealed that attackers are planting malicious, plain-text instruction files directly into a developer’s "Downloads" folder. Because many developers frequently open coding agents within their Downloads directory to test scripts or prototype code, the agents immediately ingest these malicious instructions.

The attack works through a simple but effective social engineering play. The AGENTS.md file is disguised as legitimate engineering documentation. One section of the malicious file instructs the agent to add a specific server to its configuration and execute a command to install a package named function-color from the npm repository.

The MALFEX Connection: A Chain of Infection

The package function-color is not an isolated piece of code; it is a known component of a wider malware campaign dubbed MALFEX. As documented by researchers at CloudSEK and Checkmarx, MALFEX is a multi-stage infection chain.

When an AI agent is duped into installing function-color, it unknowingly initiates a "downloader" script. This script, known as function-flag, then reaches out to a remote command-and-control (C2) server to fetch a secondary, more potent Windows payload. By simply following the "instructions" written in the AGENTS.md file, the AI agent transitions from a productivity tool to an unwitting accomplice in a remote code execution (RCE) attack.

Chronology of the Discovery

The discovery followed a series of alarming telemetry patterns observed by the Forever Security team:

• Initial Detection: Security sensors flagged an anomalous npm installation attempt on a customer’s machine. The process originated from an AI agent process, not a manual user input.
• Root Cause Analysis: Upon manual inspection of the directory, analysts found the AGENTS.md file. The file contained directives that were clearly malicious, framed as standard configuration steps.
• Reproducibility Testing: To confirm that this wasn’t an isolated anomaly, researchers built a proof-of-concept (PoC) web page. This page, when visited, automatically triggers a silent download of the malicious AGENTS.md file into the user’s Downloads folder without requiring user interaction—leveraging standard browser behaviors that allow for automated file persistence.
• Agent Stress Testing: The firm tested the attack against two prominent coding agents:
  • Codex: In isolated virtual machine environments, Codex proved highly susceptible. It followed the instructions to modify ~/.codex/config.toml in over 90% of test cases.
  • Claude Code: The attack surface was different here. The researchers used a CLAUDE.md file to attempt an account takeover. By tricking the agent into modifying the ANTHROPIC_BASE_URL, the researchers were able to redirect API traffic to a malicious server, effectively leaking session tokens. While Claude’s internal security "sanity checks" occasionally blocked the change, the agent still approved the malicious write in approximately 50% of the trials.

Supporting Data: Why Your Downloads Folder is a Hazard

The data provided by Forever Security highlights the precarious state of modern development environments. According to their telemetry, approximately 50% of their customers run coding agents within their "Downloads" directory. Furthermore, roughly 25% of all agent sessions involve the agent browsing the web directly.

This creates a "perfect storm" for attackers. When an agent is browsing the web on behalf of a user, there is often no human observer watching the screen. If a web page automatically drops a file into the Downloads folder, and the agent later scans that folder, the malicious instructions are executed before the developer even realizes a file was downloaded.

The "Not a Bug" Dilemma: Official Perspectives

A critical aspect of this discovery is the position taken by the researchers: there is currently nothing for companies like OpenAI or Anthropic to "patch" in the traditional sense.

"The agent is performing exactly as designed," the Forever Security report notes. "It is reading the instructions in the folder and following them. This is not a vulnerability in the AI model’s code, but rather a fundamental flaw in the trust model of autonomous agents."

The analogy provided by the researchers is apt: it is akin to a web browser rendering a phishing page. The browser is not "broken"—it is accurately displaying the code it was fed. The responsibility for the malicious content lies with the actor who crafted the page, not the browser that loaded it. Consequently, this places the burden of defense squarely on the shoulders of the developers and the security tools that monitor their machines.

Implications for the Future of AI Development

The implications of this attack are profound. As we move toward a future where "Agentic AI"—systems that can perform multi-step tasks, manage files, and interact with the internet—becomes the standard, the attack surface for developers will only continue to expand.

1. The Death of Implicit Trust: Currently, AI agents are designed to be helpful, often operating on an assumption of implicit trust regarding the files in a project directory. This must change. Future iterations of AI agents will likely need to implement "sandbox" environments where instruction files are validated or where the agent requires explicit, high-friction user authorization before executing any commands that modify configuration files or install external packages.
2. The Rise of "Agent-Aware" Endpoint Protection: Traditional antivirus software focuses on file signatures. Future security solutions must be "Agent-Aware," capable of analyzing the intent of instructions provided to AI models. Security platforms will need to monitor not just what a program is, but what an AI agent is being told to do.
3. The Need for Better Hygiene: Developers must move away from the habit of using the "Downloads" folder as a workspace. This directory is a high-traffic, low-security zone that is accessible to virtually every browser-based threat. Creating dedicated, isolated project directories is no longer just a best practice—it is a critical security requirement.

Recommendations: Protecting Your Environment

While there is no "patch" to apply, developers and security teams can take immediate, actionable steps to mitigate the risk of AI agent hijacking:

• Isolate Your Agent Workspaces: Never run AI agents in your "Downloads" or "Desktop" folders. Create a dedicated directory (e.g., ~/projects/ai-sandbox/) and ensure your browser is not configured to save files there automatically.
• Audit Configuration Files: Regularly review the configuration files in your agent’s workspace. If you see an AGENTS.md or CLAUDE.md file that you did not explicitly create, delete it immediately.
• Restrict Internet Access for Agents: Where possible, configure your coding agents to operate in restricted network environments. By limiting the ability of an agent to connect to external repositories or unknown servers, you can prevent the "downloader" stage of a malware attack.
• Adopt "Zero Trust" for AI Instructions: Treat instruction files with the same skepticism you would treat an email attachment from an unknown sender. If an agent asks for permission to change a configuration file or install a package, stop and verify the instruction’s source.
• Implement Endpoint Detection and Response (EDR): Ensure that your development machines are protected by robust EDR tools that can detect and block unauthorized attempts to modify system configuration files or install suspicious packages via command-line interfaces.

As the industry grapples with this new threat, one thing is clear: the convenience of autonomous AI agents comes with a cost. The security of the software supply chain now depends on our ability to distinguish between a helpful prompt and a malicious instruction. In the race to build faster and more efficiently, we must not lose sight of the basic security principles that have protected our systems for decades. The AI agent, for all its intelligence, is only as secure as the environment in which it operates.