What happened
Forever Security caught an AI coding agent mid-task installing the malicious npm package function-color, after a planted AGENTS.md in the user's Downloads folder instructed it; Codex followed such files in over 90% of tests, a Claude Code variant succeeded about 50%, and each successful Claude run shipped an OAuth token to a researcher-controlled server.
Why it matters
The attack chains two intended behaviors — browsers silently write to ~/Downloads, and agents unconditionally trust AGENTS.md in their working directory — so there is nothing for the vendors to patch, putting the burden on developers and endpoint tooling.
WHO IT HITSDevelopers who run coding agents from their Downloads folder, and the security teams who manage their endpoints, face a new path from a drive-by web page to malware installation through a tool the developer trusts.
Summaries like this, every morning.
The attack does not exploit a software bug in the agents themselves. Instead, it relies on two behaviors that are working as intended: browsers save files to the Downloads folder by design, and agents trust instruction files like AGENTS.md in whatever directory they are launched from. Forever Security's testing showed that OpenAI's Codex followed a planted file in more than 90% of attempts, while a Claude Code variant that rerouted the agent's API endpoint succeeded about half the time, and same-session code execution landed in roughly one in five tries. Each successful Claude run shipped an OAuth token to a server the researchers controlled, and they replayed it against the real API and were served as the victim.
The exposure is not hypothetical. Researcher Gal Weizman said hundreds of customers run agents including Claude Code, Codex and Cursor CLI from Downloads, and Forever puts the pattern at about half of its customer base, with roughly a quarter of agent sessions opening a real browser. The malicious package function-color is not new: Checkmarx and CloudSEK tied it to the broader MALFEX npm campaign, and it sat on the registry for roughly two years before npm replaced it with a 0.0.1-security holding version. What is new is a credible path from a drive-by web page to its installation through a tool the developer trusts. The finding arrives two days after Anthropic open-sourced its Claude Code sandbox.
Pick your industry and the AI tools you use, and get news related to your work every day.
Free · 30 seconds with Google · unsubscribe anytimeWhat is AIToday? →
Ask AI anything about this article. The AI reads this article, earlier AIToday articles, and Wikipedia, and cites its sources. Q&As are published on this page for other readers too.
Sony paid a $50,000 bounty for a PlayStation 5 vulnerability that an AI discovered, according to Mezha.net
OpenAI said GPT-5.6 Sol, operating through its Codex coding tool, autonomously completed routine measurements…
Anthropic's 335-page S-1 reports first-half revenue of $16.3 billion, up 14x from the same period in 2025, alo…
Anthropic's roughly 300-page S-1, with about 94 pages of risk factors, warns its models could pose "catastroph…
A developer published the first public release of Deepity, a C++20 predictive coding engine with hand-written…
OpenAI staff say Ultrafast, a high-speed mode in Codex, now handles security incident investigations in 10 to…
