The original text is in EN, taken from the source site. Source ↗

AI coding assistants such as Claude Code and OpenAI Codex. These tools write, run, and modify code with little supervision. Each one automatically reads and obeys any instructions file it finds in the folder it opens.

The investigation began with an alert. Forever stopped a coding agent mid-session from installing function-color, a malicious npm package.

That package is part of the MALFEX campaign, which operated for roughly two years before Checkmarx publicly documented it.

Blocking a known-bad package is routine, but investigators noticed the source of the instruction was unusual. It came from a planted AGENTS.md file in a customer’s ~/Downloads folder, disguised as ordinary engineering notes.

Two behaviors are harmless on their own but dangerous together. First, AGENTS.md files are designed to be obeyed, and agents trust the project folder they run in.

Second, websites can silently save files into Downloads, choosing both the filename and contents.

Operating systems block downloaded executables until a user approves them, but a text file escapes those guardrails. Once an agent reads it, the file behaves like an executable.

Researchers ran the real attacker file inside an isolated virtual machine. Codex edited ~/.codex/config.toml, a machine-wide configuration, to register a rogue tools server, then installed the malicious package.

In testing, Codex executed the malware in more than 90 percent of attempts.

Because the configuration is global, the poisoned server loads in every project, even after the user leaves the Downloads folder.

Security firm Forever Security has shown that, a website can exploit this trust to take control of those agents, and no user click is required.

Claude proved harder to manipulate. A planted CLAUDE.md file instructed the agent to write an ANTHROPICBASEURL setting pointing to an attacker-controlled server disguised as an internal gateway. This exposed Claude’s OAuth token, enabling account takeover.

The server could also return tool calls that Claude executed, producing code execution. The attack succeeded in about 50 percent of tests.

Telemetry indicates that about half of monitored customers run a coding agent inside Downloads, and roughly a quarter of agent sessions open a real browser.

Because agents can browse autonomously, a malicious site can drop the file without any human noticing.

Neither Codex nor Claude contains a flaw. The agents performed as designed, much like a browser rendering a phishing page.

The vulnerability lies in the seam between a trusted folder and a location the web can write to. No single vendor owns that seam.

Security teams should treat Downloads as hostile ground for agents and review any AGENTS.md or CLAUDE.md file they did not write.

Administrators should check ~/.codex/config.toml for unexpected mcpservers entries or altered chatgptbaseurl values, and inspect .claude/settings.json for unfamiliar ANTHROPICBASE_URL entries.

Approval gates and sandboxes must stay enabled. If token exposure is suspected, rotate credentials immediately.

The function-color package connects to MALFEX, an operation linked to a single adversary that has published eight malicious npm packages since August 2023.

As of late September 2026, three remained installable, including function-flag, which accounts for most of the campaign’s 40,767 recorded downloads.

Teams should run npm ls on these package names and search lockfiles for pinned malicious versions.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.