Xavfsizlik firmasi Forever Security o‘tgan hafta e’lon qilgan hisobotida ma’lum qilishicha, ishlab chiquvchining Yuklamalar (Downloads) jildida joylashgan zararli ko‘rsatma fayl ularning AI kodlash agentini ma’lum zararli npm paketini o‘rnatishga aldashga urindi.
Kompaniya ushbu urinishni haqiqiy mijoz mashinasida ushlab qoldi va agent har qanday kodni ishga tushirishidan oldin uni to‘xtatdi. Fayl jildga qanday tushib qolganini aniqlay olmadi.
Fayl AGENTS.md deb nomlangan bo‘lib, bu oddiy matnli ko‘rsatma fayl bo‘lib, Codex kabi kodlash agenti jildni ochganda o‘qiydi va ko‘rsatmalar sifatida bajaradi.
U oddiy muhandislik qaydlari sifatida niqoblangan edi. Bir bo‘lim agentga o‘z konfiguratsiyasiga server qo‘shishni va npm’dan function-color nomli paketni o‘rnatishni buyurgan.
Bu paket boshqa tadqiqotchilar alohida hujjatlashtirgan zararli dastur kampaniyasining bir qismidir: function-color function-flag deb nomlangan yuklab oluvchini chaqiradi, u esa Windows yuklamasini yuklab oladi va ishga tushiradi. Kampaniyani tahlil qilgan CloudSEK va Checkmarx tadqiqotchilari uni MALFEX deb nomlagan.
Forever aytishicha, har biri alohida zararsiz bo‘lgan ikki narsa bu ishni amalga oshiradi. Agent o‘zi ochgan jilddagi ko‘rsatma fayliga ishonish va unga bo‘ysunish uchun yaratilgan. Va veb-sahifa o‘z-o‘zidan, hech qanday bosish yoki ruxsat so‘rovisiz, nomi va mazmunini tanlab, Yuklamalar jildiga fayl saqlashi mumkin. Birgalikda, veb-sahifa agent ishonadigan jildga agent buyruq sifatida qabul qiladigan faylni tushirishi mumkin.
Tadqiqotchilar bu fayl aynan shu yo‘l bilan tushib qolganini aniqlay olmadi. To‘liq yo‘l mumkinligini tekshirish uchun u o‘z isbot-konsepsiya sahifasini yaratdi: uni ochsangiz, AGENTS.md fayli Yuklamalar jildiga jimjit ravishda yuklanadi. Haqiqiy hujumchi mijozga qarshi shu yo‘ldan foydalanganmi, noma’lum.
So‘ngra firma hujumni ikkita kodlash agentida takrorladi va bu faqat bitta mahsulotga xos emasligini ko‘rsatdi. Codexga qarshi, haqiqiy hujumchi faylini izolyatsiya qilingan virtual mashinada ishga tushirdi. Oddiy loyiha sozlamalari sifatida niqoblangan fayl Codexga ~/.codex/config.toml faylida server ro‘yxatdan o‘tkazishni va paketni o‘rnatadigan buyruqni bajarishni buyurdi.
Bu konfiguratsiya fayli mashinadagi har bir Codex sessiyasiga taalluqli bo‘lgani uchun, o‘zgartirish keyinchalik har qanday jildda, faqat Yuklamalarda emas, hujumchining serverini yuklaydi. Forever aytishicha, Codex zararli dasturiy ta’minotni urinishlarning 90% dan ortig‘ida ishga tushirgan.
Claude Codega qarshi ishlaydigan hujum boshqacha ko‘rinishda bo‘ldi va kamroq muvaffaqiyatga erishdi. Joylashtirilgan CLAUDE.md, ichki shlyuz sozlamalari sifatida niqoblangan, Claude’ni loyihani sozlash fayliga ANTHROPICBASEURL yozishga majbur qilishga urindi, bu esa API trafikini Forever nazorat qiladigan serverga yo‘naltiradi. Bu yagona o‘zgartirish sessiyaning kirish tokenini sizdiradi, bu esa o‘z-o‘zidan hisobni egallab olish demakdir, va server model sifatida javob qaytarib, agent bajaradigan buyruqlarni qaytarishi mumkin.
Claude bunday yozuvni tasdiqlash uchun odamdan ruxsat so‘raydi va ko‘pincha noto‘g‘ri ko‘ringanini rad etadi; uzun muhandislik hujjati niqobi yozuvni taxminan yarmida tasdiqlashga olib keldi, deb tadqiqotchilar aytdi.
Forever fikricha, OpenAI yoki Anthropic tuzatishi mumkin bo‘lgan hech narsa yo‘q, chunki agent o‘z jildidagi ko‘rsatma faylini bajarishi — bu u yaratilgan ishni bajarayotganidir. Kompaniya buni brauzer fishing sahifasini ko‘rsatishi bilan solishtirdi: brauzer mo‘ljallanganidek ishladi, hujum esa sahifada. “Bu yerda OpenAI yoki Anthropic tuzatishi mumkin bo‘lgan hech narsa yo‘q,” deb aytdi Forever.
Nima qilish kerak
Foreverning maslahati amaliy va hech qanday mahsulotni talab qilmaydi:
- Codex, Claude Code yoki har qanday agentni ~/Downloads jildida ishga tushirmang. Bu veb o‘z-o‘zidan yozishi mumkin bo‘lgan yagona jild.
- Siz yozmagan ko‘rsatma fayllarini qidiring. Yuklamalarda yoki siz hozirgina klonlagan omborda joylashgan begona AGENTS.md yoki CLAUDE.md — bu butun hujumdir. Agentni unga yaqinlashtirishdan oldin uni o‘qing.
- Agentning o‘z konfiguratsiyasini tekshiring. ~/.codex/config.toml faylida siz qo‘shmagan server bloki yoki o‘zgartirilgan asosiy URLni kuzating. Loyihaning .claude/settings.json faylida siz o‘rnatmagan ANTHROPICBASEURL yoki boshqa API nuqtasini kuzating.
- Tasdiqlash so‘rovlari va qum qutilarini yoqib qo‘ying va agentga ularni o‘chirishni buyuradigan har qanday narsadan ehtiyot bo‘ling.
- Agar joylashtirilgan faylni topsangiz, kirish tokeni sizdirilgan deb hisoblang va uni aylantiring. O‘g‘irlangan token — bu faqat bitta ushlangan so‘rov emas, balki jonli sessiya.
O‘z telemetriyasida Forever aytishicha, mijozlarining taxminan yarmi kodlash agentini Yuklamalar jildida ishga tushiradi va agent sessiyalarining taxminan choragi brauzerni ochadi.
Bu hujumga kerakli shartlar: agent veb yozishi mumkin bo‘lgan joyda ishga tushadi va ko‘p hollarda agent o‘zi brauzer qiladi, shuning uchun fayl kelganda hech kim kuzatmaydi.
Ushbu maqola sizga qiziqarli tuyuldimi? Bizni Google News, Twitter va LinkedIn’da kuzating, biz e’lon qiladigan eksklyuziv kontentni o‘qish uchun.
A malicious instruction file sitting in a developer's Downloads folder tried to make their AI coding agent install a known-malicious npm package, security firm Forever Security said in a report published last week.
The company caught the attempt on a real customer's machine and stopped the agent before any code ran. It could not determine how the file got into the folder.
The file was AGENTS.md, a plain-text instructions file that a coding agent, such as OpenAI's Codex, reads when it starts in a folder and follows as directions.
It was dressed up as ordinary engineering notes. One section told the agent to add a server to its own configuration and install a package called function-color from npm.
That package is part of a malware campaign that other researchers have documented separately: function-color pulls in a downloader called function-flag, which fetches and runs a Windows payload. Researchers at CloudSEK and Checkmarx, who analyzed the campaign, named it MALFEX.
Two things, each harmless on its own, make this work, Forever said. An agent is built to trust and obey the instructions file in the folder it opens. And a web page can save a file to the Downloads folder on its own, without a click or a permission prompt, choosing the name and contents. Put together, a web page can drop a file the agent will treat as orders into a folder the agent trusts.
Researchers did not establish that this is how the file was caught. To test whether the full path was possible, it built its own proof-of-concept page: visit it, and an AGENTS.md downloads silently into Downloads. Whether a real attacker used that route against the customer is not known.
The firm then reproduced the attack on two coding agents to show that it was not specific to a single product. Against Codex, it ran the real attacker file inside an isolated virtual machine. The file, framed as routine project setup, told Codex to register a server in ~/.codex/config.toml and run a command that installed the package.
Video 3
Because that config file applies to every Codex session on the machine, the change would load the attacker's server in any folder afterward, not just Downloads. Codex ran the malware in more than 90% of attempts, Forever said.
Against Claude Code, the working attack looked different and succeeded less often. A planted CLAUDE.md, framed as internal gateway setup, tried to make Claude write an ANTHROPICBASEURL into a project settings file, pointing its API traffic at a server Forever controlled. That one change leaks the session's login token, which is account takeover on its own, and lets the server reply as if it were the model and hand back commands the agent runs.
Claude needs a person to approve a write like that and often refuses one that looks wrong; the long engineering-doc framing got the write approved about half the time, researchers said.
There is nothing for OpenAI or Anthropic to patch, in Forever's view, because an agent following the instructions file in its folder is doing what it was built to do. The company compared it to a browser rendering a phishing page: the browser worked as designed, and the attack lies in the page. "There is nothing here for OpenAI or Anthropic to patch," Forever said.
What to do
Forever's advice is practical and needs no product:
- Do not start Codex, Claude Code, or any agent in ~/Downloads. It is the one folder the web can write to on its own.
- Look for instructions files you did not write. A stray AGENTS.md or CLAUDE.md, in Downloads or in a repository you just cloned, is the whole attack. Read it before you let an agent near it.
- Check the agent's own config. In ~/.codex/config.toml, watch for a server block or a changed base URL you did not add. In a project's .claude/settings.json, watch for an ANTHROPICBASEURL or other API endpoint you did not set.
- Leave approval prompts and sandboxes on, and be wary of anything that tells the agent to switch them off.
- If you find a planted file, assume the login token leaked and rotate it. A stolen token is a live session, not just one caught request.
In its own telemetry, Forever said that about half of its customers run a coding agent in their Downloads folder, and roughly a quarter of agent sessions open a browser.
Those are the conditions the attack needs: an agent starts where the web can write, and, in many cases, an agent does the browsing itself, so no person is watching when a file arrives.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.