Executive Summary
A malicious instruction file attempted to manipulate an AI coding agent into installing malware and altering persistent agent configuration. Developers, security teams, and organizations deploying coding agents should address this as an indirect prompt-injection and excessive-agency risk.
What Happened
A malicious instruction file sitting in a developer's Downloads folder tried to make their AI coding agent install a known-malicious npm package, security firm Forever Security said in a report published last week. The company caught the attempt on a real customer's machine and stopped the agent before any code ran. It could not determine how the file got into the folder. The file
Affected Products
- OpenAI Codex
- Claude Code
- function-color
- function-flag
- AGENTS.md
Vulnerability / Attack Technique
Indirect prompt injection through a malicious instruction file
Technical Mechanism
The AGENTS.md file was presented as ordinary engineering notes but directed the agent to register a server in its configuration and install function-color from npm. The reported package pulls in function-flag, which fetches and runs a Windows payload; the Codex test also showed that configuration changes could affect later sessions.
AI Security Category
LLM01:2025 Prompt Injection
Part of the Prompt Injection topic.
Relevant Frameworks
RealGround Analysis
AI agents that automatically read local instruction files create a trust boundary between untrusted files and privileged actions. Persistent configuration changes and unrestricted package installation can turn a single injected instruction into a recurring compromise path, so agent workflows require explicit approval and isolation for high-impact operations.
Recommended Controls
- Treat instruction files in Downloads and other untrusted directories as untrusted input and require explicit user approval before following them.
- Require approval, allowlisting, and sandboxing for package installation, server registration, configuration changes, and shell execution.
- Run coding agents with least-privilege accounts, isolated workspaces, restricted network access, and ephemeral sessions.
- Monitor and version-control agent configuration files, including ~/.codex/config.toml, and alert on unexpected MCP or server registrations.
- Use npm package provenance checks, lockfiles, malware scanning, and private-registry controls before allowing agent-initiated dependency installation.
Related RealGround Service
AI Agent Business Logic Audit · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/10/malicious-file-in-downloads-folder.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-26.