Forever Security found a malicious AGENTS.md sitting in a customer's ~/Downloads folder. That folder was also the agent's working directory. The file tricked an AI coding agent into trying to install a rogue npm package called function-color . BleepingComputer covered the research , and the numbers are worth reading slowly.

Researchers reproduced the attack against OpenAI Codex with a 90% success rate. They also used a malicious CLAUDE.md to redirect Claude Code's API traffic to an attacker-controlled server. That leaked the OAuth token and enabled spoofed tool calls, which executed code in roughly 50% of tests. A web page can silently drop the instruction file into Downloads, and hundreds of customers reportedly launch agents from that folder.

So the attacker needs a browser tab and a user who runs their agent from the wrong directory.

How it worked

Coding agents read project instruction files from the working directory.…