Claude Code va OpenAI Codex kabi AI kodlash yordamchilari. Bu vositalar kodni kam nazorat bilan yozadi, ishga tushiradi va o'zgartiradi. Har biri ochgan jildida topgan har qanday ko'rsatma faylini avtomatik ravishda o'qiydi va unga bo'ysunadi.
Tergov ogohlantirish bilan boshlandi. Forever kodlash agentini sessiya o'rtasida function-color, zararli npm paketini o'rnatishdan to'xtatdi.
Bu paket MALFEX kampaniyasining bir qismi bo'lib, Checkmarx uni ommaviy hujjatlashtirishdan oldin taxminan ikki yil davomida faoliyat yuritgan.
Ma'lum yomon paketni bloklash odatiy ish, ammo tergovchilar ko'rsatma manbai g'ayrioddiy ekanini payqashdi. U mijozning ~/Downloads jildiga joylashtirilgan, oddiy muhandislik qaydlari sifatida niqoblangan AGENTS.md faylidan kelgan.
Ikkita xatti-harakat alohida zararsiz, ammo birgalikda xavfli. Birinchidan, AGENTS.md fayllari bo'ysunish uchun mo'ljallangan va agentlar ishlaydigan loyiha jildiga ishonadi.
Ikkinchidan, veb-saytlar fayllarni Yuklamalar jildiga jimgina saqlashi mumkin, ham fayl nomini, ham mazmunini tanlab.
Operatsion tizimlar yuklab olingan bajariladigan fayllarni foydalanuvchi tasdiqlamaguncha bloklaydi, ammo matn fayli bu himoya choralaridan qochadi. Agent uni o'qigach, fayl bajariladigan fayl kabi ishlaydi.
Tadqiqotchilar haqiqiy hujumchi faylini izolyatsiya qilingan virtual mashinada ishga tushirishdi. Codex ~/.codex/config.toml, mashina darajasidagi konfiguratsiyani tahrirlab, zararli vositalar serverini ro'yxatdan o'tkazdi, so'ngra zararli paketni o'rnatdi.
Sinovda Codex zararli dasturiy ta'minotni 90 foizdan ortiq urinishlarda bajardi.
Konfiguratsiya global bo'lgani uchun, zaharlangan server har bir loyihada yuklanadi, hatto foydalanuvchi Yuklamalar jildidan chiqqanidan keyin ham.
Forever Security xavfsizlik firmasi veb-sayt bu ishonchni suiiste'mol qilib, agentlarni nazoratga olishi mumkinligini va buning uchun foydalanuvchi bosishi talab qilinmasligini ko'rsatdi.
Claude'ni manipulyatsiya qilish qiyinroq bo'ldi. Joylashtirilgan CLAUDE.md fayli agentga ANTHROPICBASEURL sozlamasini ichki shlyuz sifatida niqoblangan hujumchi nazoratidagi serverga yo'naltirishni buyurdi. Bu Claude'ning OAuth tokenini fosh qildi va hisobni egallashga imkon berdi.
Server shuningdek Claude bajargan vosita chaqiruvlarini qaytarishi mumkin edi, bu esa kod bajarilishiga olib keldi. Hujum sinovlarning taxminan 50 foizida muvaffaqiyatli bo'ldi.
Telemetriya ma'lumotlari kuzatilgan mijozlarning taxminan yarmi kodlash agentini Yuklamalar jildida ishlatishini va agent sessiyalarining taxminan choragi haqiqiy brauzerni ochishini ko'rsatadi.
Agentlar avtonom ravishda ko'rishi mumkinligi sababli, zararli sayt faylni hech kim sezmasdan joylashtirishi mumkin.
Codex ham, Claude ham kamchilikka ega emas. Agentlar mo'ljallanganidek ishladi, xuddi brauzer fishing sahifasini ko'rsatgandek.
Zaiflik ishonchli jild va veb yozishi mumkin bo'lgan joy o'rtasidagi chegarada yotadi. Hech bir yagona sotuvchi bu chegaraga egalik qilmaydi.
Xavfsizlik jamoalari Yuklamalarni agentlar uchun dushman hududi sifatida ko'rishi va o'zlari yozmagan har qanday AGENTS.md yoki CLAUDE.md faylini tekshirishi kerak.
Administratorlar ~/.codex/config.toml faylida kutilmagan mcpservers yozuvlari yoki o'zgartirilgan chatgptbaseurl qiymatlarini, shuningdek .claude/settings.json faylida notanish ANTHROPICBASE_URL yozuvlarini tekshirishi kerak.
Tasdiqlash darvozalari va qum qutilari yoqilgan holda qolishi kerak. Agar token fosh bo'lishi gumon qilinsa, ma'lumotlarni darhol aylantiring.
function-color paketi MALFEX bilan bog'liq, bu yagona dushmanga bog'liq operatsiya bo'lib, 2023-yil avgustidan beri sakkizta zararli npm paketini e'lon qilgan.
2026-yil sentyabr oxiriga ko'ra, uchta paket o'rnatilishi mumkin edi, jumladan function-flag, bu kampaniyaning 40 767 ta qayd etilgan yuklab olishlarining aksariyatini tashkil qiladi.
Jamoalar bu paket nomlari bo'yicha npm ls buyrug'ini ishga tushirishi va zararli versiyalarni qidirish uchun lockfayllarni tekshirishi kerak.
AI coding assistants such as Claude Code and OpenAI Codex. These tools write, run, and modify code with little supervision. Each one automatically reads and obeys any instructions file it finds in the folder it opens.
The investigation began with an alert. Forever stopped a coding agent mid-session from installing function-color, a malicious npm package.
That package is part of the MALFEX campaign, which operated for roughly two years before Checkmarx publicly documented it.
Blocking a known-bad package is routine, but investigators noticed the source of the instruction was unusual. It came from a planted AGENTS.md file in a customer’s ~/Downloads folder, disguised as ordinary engineering notes.
Two behaviors are harmless on their own but dangerous together. First, AGENTS.md files are designed to be obeyed, and agents trust the project folder they run in.
Second, websites can silently save files into Downloads, choosing both the filename and contents.
Operating systems block downloaded executables until a user approves them, but a text file escapes those guardrails. Once an agent reads it, the file behaves like an executable.
Researchers ran the real attacker file inside an isolated virtual machine. Codex edited ~/.codex/config.toml, a machine-wide configuration, to register a rogue tools server, then installed the malicious package.
In testing, Codex executed the malware in more than 90 percent of attempts.
Because the configuration is global, the poisoned server loads in every project, even after the user leaves the Downloads folder.
Security firm Forever Security has shown that, a website can exploit this trust to take control of those agents, and no user click is required.
Claude proved harder to manipulate. A planted CLAUDE.md file instructed the agent to write an ANTHROPICBASEURL setting pointing to an attacker-controlled server disguised as an internal gateway. This exposed Claude’s OAuth token, enabling account takeover.
The server could also return tool calls that Claude executed, producing code execution. The attack succeeded in about 50 percent of tests.
Telemetry indicates that about half of monitored customers run a coding agent inside Downloads, and roughly a quarter of agent sessions open a real browser.
Because agents can browse autonomously, a malicious site can drop the file without any human noticing.
Neither Codex nor Claude contains a flaw. The agents performed as designed, much like a browser rendering a phishing page.
The vulnerability lies in the seam between a trusted folder and a location the web can write to. No single vendor owns that seam.
Security teams should treat Downloads as hostile ground for agents and review any AGENTS.md or CLAUDE.md file they did not write.
Administrators should check ~/.codex/config.toml for unexpected mcpservers entries or altered chatgptbaseurl values, and inspect .claude/settings.json for unfamiliar ANTHROPICBASE_URL entries.
Approval gates and sandboxes must stay enabled. If token exposure is suspected, rotate credentials immediately.
The function-color package connects to MALFEX, an operation linked to a single adversary that has published eight malicious npm packages since August 2023.
As of late September 2026, three remained installable, including function-flag, which accounts for most of the campaign’s 40,767 recorded downloads.
Teams should run npm ls on these package names and search lockfiles for pinned malicious versions.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.