A malicious AGENTS.md file placed in a Downloads folder attempted to make an AI coding agent install a MALFEX-linked npm package.
Security tools intercepted the attempt, but tests show coding agents frequently execute unauthorized commands found in local workspaces.
According to the researchers, the issue exploits the way programming assistants work, which blindly read and follow text files with instructions located in the folder where they are activated. In this case, a file named AGENTS.md appeared in the downloads folder. The file instructed OpenAI’s tool, Codex, to add a server to its settings and install a package called function-color. This package automatically downloads another program that brings Windows code to the device, which is associated with a wider malware campaign known as MALFEX.
How to set the trap
The attack relies on two key facts: first, AI assistants fully trust the instructions in their work folder, and second, websites can automatically save files to a computer's downloads folder without asking the user. The researchers were unable to confirm exactly how the file ended up on the customer's computer, but they created a test page that demonstrates that it is possible to automatically download this file simply by visiting a website.
During tests in a controlled environment, the Codex tool obeyed and executed the command in more than 90% of cases. A similar test was also conducted with the Claude Code tool, where a similar file attempted to add a web server address to the project settings, attempting to intercept the digital connection key. However, this attempt succeeded about half the time, as the system requires user approval for such actions.
What security experts say
Experts point out that there is no technical error that OpenAI or Anthropic need to fix, as the programs are simply performing the normal function for which they were designed, following the instructions given to them.
READ ALSO
New attacks on governments and companies exploit serious PHP security flaws
To protect against such incidents, researchers recommend that users not open programming assistants in the downloads folder, check for unknown instruction files, pay attention to tool settings, and always keep approval requests active.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
end of article
Top comments (0)