Planted instructions file tries to trick AI coding agents into installing malicious npm package

Forever Security caught an attempt on a customer's machine to subvert an AI coding agent through a planted instructions file. Coding agents read AGENTS.md or CLAUDE.md files in a folder and follow them, and a web page can drop such a file into Downloads without a click. The disguised file told OpenAI Codex to register a server in its global config and install the npm package function-color, part of the MALFEX campaign, which pulls a Windows payload. Against Claude Code, a CLAUDE.md tried to set ANTHROPIC_BASE_URL to an attacker server to leak the login token. Researchers say there is nothing for vendors to patch.

Check

Do not run coding agents in the Downloads folder, and read any AGENTS.md or CLAUDE.md you did not write before letting an agent act on it.

Affected

Developers whose coding agent reads an attacker-planted instructions file can have it install malicious npm packages or redirect its base URL to leak login tokens.

Fix

Keep agent approval prompts and sandboxes on, inspect config files like the Codex config and project settings for unexpected changes, and rotate tokens if a planted file is found.