Web Pages Can Command AI Coding Agents: Over 90% Success Through the Downloads Folder

Web pages can trigger malware execution through AI coding agents, as demonstrated with over 90% success in tests conducted by Forever Security. This occurs when an AGENTS.md file is placed in the Downloads folder, instructing an AI agent like OpenAI Codex or Claude Code to install malicious packages. The issue stems from two seemingly harmless behaviors: browsers saving files to Downloads automatically, and AI agents following instruction files without user interaction. This combination allows a single text file to compromise the system.

Forever Security detected a malicious AI agent attempting to install the known malware function-color, part of the MALFEX campaign. The malware is installed in a package called function-flag, which is a dependency of function-color. The attack file in the Downloads folder disguised the malicious code as a routine setup step within a long, technical document, bypassing defenses that typically protect executable files.

The compromise persists even after leaving the folder, as the attacker rewrites the machine-wide configuration file to register their project tools server across the system. Claude Code also fell victim to this attack, with a CLAUDE.md file redirecting API traffic to a researcher-controlled server. This leaked OAuth tokens and allowed the attacker to impersonate the model and execute code within the same session.

To prevent such attacks, it's recommended to run coding agents from the project directory being worked on, as advised by OpenAI and Anthropic. However, this recommendation is not followed by many developers, who often run agents in the Downloads folder. Forever Security's customer telemetry shows that roughly half of its customers run agents in this folder, making them particularly vulnerable to this type of attack.