EN PT-BR
← Voltar ao feed
high technology software development

Malicious AGENTS.md planted in Downloads hijacks Codex and Claude Code to install MALFEX npm package function-color

3 fonte(s) · 3 atualização(ões) · publicado 25/10/2026 12:49 · coletado há 6 dias

Matéria consolidada. Reúne 3 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 27/10/2026 00:01; os links antigos trazem para cá.

Fontes: gbhackers.com ↗ thehackernews.com ↗ bleepingcomputer.com ↗

Forever Security reported that a malicious AGENTS.md instruction file in a real customer's ~/Downloads folder tried to make an AI coding agent install the malicious npm package function-color, which belongs to the MALFEX campaign (thehackernews.com, gbhackers.com). Forever stopped the agent before any code ran and could not determine how the file reached the folder (thehackernews.com, bleepingcomputer.com). The researchers argue that a web page can silently drop such a file into Downloads, and that an agent launched from that folder loads and obeys it. They reproduced the attack against OpenAI Codex and showed a related technique against Claude Code that leaks OAuth tokens and enables account takeover. Whether a real attacker used the web-drop route against the customer is unknown (thehackernews.com). Forever holds that there is nothing for OpenAI or Anthropic to patch, because the agents behave as designed (bleepingcomputer.com, thehackernews.com).

Entenda a falha

A vulnerabilidade

No CVE. Forever Security describes a design weakness in how AI coding agents trust their working folder, not a bug in one product, so no affected or fixed versions are given. A web page can silently save an AGENTS.md or CLAUDE.md into ~/Downloads, and OpenAI Codex or Claude Code obeys it if launched from that folder. The attacker needs no click or credentials, only that the victim runs an agent in Downloads. Codex was made to register a rogue MCP server and install the MALFEX npm package function-color. Claude Code was made to leak its OAuth token and run attacker tool calls. Forever says OpenAI and Anthropic have nothing to patch.

Como funciona

A web page saves a text file into Downloads, choosing its name and contents. The OS blocks downloaded executables until approved, but a text file raises no such barrier. When the user starts an agent in that folder, it loads AGENTS.md or CLAUDE.md as trusted project instructions and follows them. In Codex, the real attacker file, framed as routine project setup, led it to edit the global ~/.codex/config.toml to add a rogue tools server and run the install command for function-color, which pulls in the downloader function-flag that fetches a Windows payload. In Claude Code, a CLAUDE.md framed as gateway setup led it to write ANTHROPIC_BASE_URL into a project settings file, pointing traffic at an attacker server that received the token and could return tool calls for Claude to run.

Por que é vulnerável

The root cause is a trust-boundary mismatch. Agents are built to obey the instruction file in the folder they open and treat it as trusted, while Downloads is the one folder the web can write to on its own, with attacker-chosen names and contents. Text files also escape the OS controls that stop downloaded executables. Forever says the agents work as designed, like a browser rendering a phishing page, and that no single vendor owns the seam. Claude's approval prompt for the settings write is a partial barrier, but long engineering-style framing got it approved about half the time. No fix is described; the advice is to treat Downloads as hostile and keep approval gates and sandboxes on.

Onde está

No code is named. The articles point to agent settings: ~/.codex/config.toml (mcp_servers entries, chatgpt_base_url) for Codex, and .claude/settings.json (ANTHROPIC_BASE_URL) for Claude Code, plus any unexpected AGENTS.md or CLAUDE.md file.

Como foi descoberta

Forever Security's product blocked a coding agent mid-session from installing function-color on a real customer's machine, before any code ran. Investigators traced the instruction to a planted AGENTS.md in the customer's ~/Downloads, disguised as engineering notes, which was also the agent's working directory. They could not determine how the file got there, and it is unknown whether the web-drop route was used. They then reproduced the attack in an isolated VM: Codex ran the malware in over 90% of attempts with the real file, and the Claude Code attack worked in about 50%. MALFEX, documented by CloudSEK and Checkmarx, had run for about two years. The sources differ on telemetry: about half of Forever's customers (The Hacker News, GBHackers) versus hundreds of customers (BleepingComputer) run agents in Downloads.

PoC pública

Forever Security built a proof-of-concept web page that silently drops an AGENTS.md into Downloads when visited, to show the web-drop step is possible. BleepingComputer verified it: the file it saved had harmless content. This shows only the drop step, not a weaponized exploit; the Codex and Claude Code chains were demonstrated in Forever's own tests (Codex about 90% with a harmless calculator payload per BleepingComputer). No address for the page appears in the articles. Since the technique needs only a text file and an agent launched in Downloads, defenders should not wait for a patch and should act on the mitigations now.

Explicação gerada por IA a partir da matéria e dos artigos, em 27/10/2026 00:17.

Detalhes técnicos

  • Agents load instruction files such as AGENTS.md and CLAUDE.md from their working directory and can run commands, install packages or change settings with the permissions they have (bleepingcomputer.com). Text files escape the OS guardrails that block downloaded executables (gbhackers.com).
  • The real file was disguised as ordinary engineering notes. It told the agent to add a server to its own configuration and install function-color, which pulls in the downloader function-flag, which fetches and runs a Windows payload (thehackernews.com).
  • Web drop: Chrome, Edge and Firefox save to Downloads by default without prompting, though they show download notifications. Brave prompted for approval in BleepingComputer's test. BleepingComputer verified Forever's proof-of-concept page, which dropped an AGENTS.md with harmless content (bleepingcomputer.com).
  • Codex: run in an isolated VM, the real attacker file made Codex edit the global ~/.codex/config.toml to register a rogue tools (MCP) server and then run the install command. Because the config is global, the attacker's server would load in any folder afterward (thehackernews.com, gbhackers.com). The malware ran in more than 90% of attempts (thehackernews.com, gbhackers.com).
  • Claude Code: a planted CLAUDE.md, framed as internal gateway setup, told Claude to write ANTHROPIC_BASE_URL into a project settings file, pointing API traffic at a Forever-controlled server posing as an internal gateway. This exposes the OAuth/session token (account takeover), and the server can impersonate the model and return tool calls that the agent executes (all three sources). Claude requires approval for the write and often refuses, but the long engineering-doc framing got it approved about half the time (thehackernews.com).
  • Exposure: the attack needs the victim to launch an agent from ~/Downloads. Forever telemetry shows about half of its customers run a coding agent in Downloads and roughly a quarter of agent sessions open a browser, so autonomous browsing could let a malicious site drop the file unnoticed (thehackernews.com, gbhackers.com). Claude Code alone launched more than 1,300 sessions from that location, and Codex and Cursor CLI are also used this way (bleepingcomputer.com).
  • MALFEX was documented separately by CloudSEK and Checkmarx (thehackernews.com). It is linked to a single adversary that has published eight malicious npm packages since August 2023 and operated for about two years before Checkmarx documented it. As of late September 2026 three packages remained installable, including function-flag, which accounts for most of the 40,767 recorded downloads (gbhackers.com).

Remediação

  • Do not start Codex, Claude Code, Cursor CLI or any agent in ~/Downloads or other broad directories. Start agents in the root of the specific project.
  • Look for AGENTS.md or CLAUDE.md files you did not write, including in freshly cloned repositories, and read them before letting an agent use them.
  • Check ~/.codex/config.toml for unexpected server blocks (mcp_servers) or altered base URLs such as chatgpt_base_url, and .claude/settings.json for an unexpected ANTHROPIC_BASE_URL or other API endpoint.
  • Keep approval prompts and sandboxes enabled, and be wary of instructions to disable them. Test potentially untrusted code in an isolated environment.
  • If a planted file is found or token exposure is suspected, assume the login token leaked and rotate credentials immediately.
  • Run npm ls for the MALFEX package names (function-color, function-flag) and search lockfiles for pinned malicious versions.

Relatos divergentes

  • Codex success rate: BleepingComputer reports about 90% for a harmless payload (opening the calculator) (bleepingcomputer.com). The Hacker News and GBHackers report more than 90% with the real attacker file executing the malware in an isolated VM (thehackernews.com, gbhackers.com). These are different test setups, not a real contradiction.
  • Telemetry framing: bleepingcomputer.com says hundreds of customers launch agents from Downloads, while thehackernews.com and gbhackers.com say about half of Forever's customers do. The sources do not reconcile the figures.
  • MALFEX attribution: bleepingcomputer.com does not mention the campaign. The link to MALFEX comes from thehackernews.com and gbhackers.com.

Linha do tempo

  1. gbhackers.com ↗ · pub. 26/10/2026 05:27 · coletado 26/10 06:00

    Forever Security shows websites can hijack Codex and Claude Code by planting AGENTS.md/CLAUDE.md files in Downloads, delivering MALFEX npm malware

    ler a análise desta fonte

    Forever Security reported that a website can take control of AI coding agents such as OpenAI Codex and Claude Code without any user click. The site silently drops an instruction file (AGENTS.md or CLAUDE.md) into the victim's ~/Downloads folder, and an agent opened in that folder obeys it. The investigation began when Forever blocked an agent mid-session from installing function-color, a malicious npm package tied to the MALFEX campaign. The instruction came from a planted AGENTS.md disguised as engineering notes. The researchers say neither agent has a flaw: the weakness is the seam between a trusted folder and a location the web can write to.

    Technical Details

    • Text files escape the OS guardrails that block downloaded executables, so once an agent reads the file it behaves like one.
    • Codex: in an isolated VM test with the real attacker file, Codex edited the global ~/.codex/config.toml to register a rogue tools (MCP) server and then installed the malicious package. It executed the malware in more than 90% of attempts. Because the configuration is global, the poisoned server loads in every project.
    • Claude Code: a planted CLAUDE.md told the agent to set ANTHROPIC_BASE_URL to an attacker-controlled server posing as an internal gateway. This exposed the OAuth token, enabling account takeover, and the server could return tool calls that Claude executed, giving code execution. It succeeded in about 50% of tests.
    • Telemetry shows about half of monitored customers run a coding agent inside Downloads, and roughly a quarter of agent sessions open a real browser, so autonomous browsing could let a malicious site drop the file unnoticed.
    • MALFEX is linked to a single adversary that has published eight malicious npm packages since August 2023. It operated for about two years before Checkmarx documented it. As of late September 2026 three packages remained installable, including function-flag, which accounts for most of the 40,767 recorded downloads.

    Remediation

    • Treat Downloads as hostile ground for agents, and review any AGENTS.md or CLAUDE.md file you did not write.
    • Check ~/.codex/config.toml for unexpected mcp_servers entries or altered chatgpt_base_url values, and inspect .claude/settings.json for unfamiliar ANTHROPIC_BASE_URL entries.
    • Keep approval gates and sandboxes enabled.
    • Rotate credentials immediately if token exposure is suspected.
    • Run npm ls for the MALFEX package names and search lockfiles for pinned malicious versions.
  2. thehackernews.com ↗ · pub. 26/10/2026 03:03 · coletado 26/10 05:00

    Malicious AGENTS.md in Downloads folder tried to make AI coding agent install MALFEX npm package function-color

    ler a análise desta fonte

    Forever Security reported that a malicious AGENTS.md instruction file in a developer's Downloads folder tried to make an AI coding agent install the known-malicious npm package function-color. The firm caught the attempt on a real customer's machine and stopped the agent before any code ran. It could not determine how the file reached the folder. The package belongs to the MALFEX campaign, documented separately by CloudSEK and Checkmarx. Forever's reproductions showed that OpenAI Codex ran the malware in more than 90% of attempts, and that Claude Code was also exploitable, though less reliably.

    Technical Details

    • The file was disguised as ordinary engineering notes. It told the agent to add a server to its own configuration and install function-color, which pulls in the downloader function-flag, which fetches and runs a Windows payload.
    • Forever argues the attack combines two behaviours that are harmless alone. Agents trust and obey the instructions file in the folder they open, and a web page can silently save a file with an attacker-chosen name and content to Downloads. Forever built a proof-of-concept page that drops an AGENTS.md this way. It is not known whether a real attacker used this route against the customer.
    • Codex: the real attacker file was run in an isolated VM. Framed as project setup, it told Codex to register a server in ~/.codex/config.toml and run the install command. Because that config applies to every Codex session, the attacker's server would load in any folder afterward.
    • Claude Code: a planted CLAUDE.md, framed as internal gateway setup, tried to make Claude write an ANTHROPIC_BASE_URL into a project settings file, pointing API traffic at a server Forever controlled. This leaks the session login token (account takeover) and lets the server return commands the agent executes. Claude requires approval for such a write and often refuses, but the long engineering-doc framing got it approved about half the time.
    • Forever telemetry: about half of its customers run a coding agent in Downloads, and roughly a quarter of agent sessions open a browser.
    • Forever holds that there is nothing for OpenAI or Anthropic to patch, since the agent behaves as designed.

    Remediation

    • Do not start Codex, Claude Code or any agent in ~/Downloads.
    • Look for AGENTS.md or CLAUDE.md files you did not write, including in freshly cloned repositories, and read them before letting an agent near them.
    • Check ~/.codex/config.toml for unexpected server blocks or changed base URLs, and .claude/settings.json for an unexpected ANTHROPIC_BASE_URL or other API endpoint.
    • Keep approval prompts and sandboxes on, and be wary of instructions to disable them.
    • If a planted file is found, assume the login token leaked and rotate it.
  3. bleepingcomputer.com ↗ · pub. 25/10/2026 12:49 · coletado 25/10 13:00 primeiro registro

    Malicious AGENTS.md in Downloads folder hijacks AI coding agents (Codex, Claude Code) to install rogue npm package

    ler a análise desta fonte

    Researchers at Forever Security found a malicious AGENTS.md instruction file in a customer's ~/Downloads folder that led an AI coding agent to try installing the malicious npm package function-color. The folder was also the agent's working directory, so the agent loaded the file automatically and followed its instructions. The researchers reproduced the attack against OpenAI Codex and showed a related technique against Claude Code that leaked OAuth tokens and allowed account hijacking. They could not determine how the file reached the customer's Downloads folder. They argue a web page could silently drop it there without user interaction. The researchers say there is nothing for OpenAI or Anthropic to patch, because the agents are behaving as designed.

    Technical Details

    • Agents load instruction files such as AGENTS.md and CLAUDE.md from their working directory. Malicious instructions can make them run commands, install packages or change settings with the tools and permissions available to them.
    • A web page can download a file named AGENTS.md into ~/Downloads silently. Chrome, Edge and Firefox save to Downloads by default without prompting, though they show download notifications. Brave prompted for approval in BleepingComputer's test. BleepingComputer verified the PoC page, which dropped an AGENTS.md with harmless content.
    • The attack requires the victim to launch an AI agent from ~/Downloads. Forever's telemetry shows hundreds of customers do this with Claude Code, OpenAI Codex and Cursor CLI. Claude Code alone launched more than 1,300 sessions from that location.
    • Against Codex, a harmless payload (opening the calculator) succeeded in about 90% of tests.
    • A malicious CLAUDE.md redirected Claude Code API traffic to an attacker-controlled server. This exposed the OAuth token and let the server impersonate the model and return tool calls that executed code, in roughly 50% of tests.

    Remediation

    • Do not use ~/Downloads or other broad directories as an AI agent's working directory. Start agents in the root of the specific project.
    • Review unfamiliar AGENTS.md, CLAUDE.md and similar instruction files before the agent follows them.
    • Keep approval prompts and sandbox protections enabled.
    • Test potentially untrusted code in an isolated environment.