What Happened
Security firm Forever Security caught an attack on a real customer’s machine: a malicious instruction file in the Downloads folder tried to trick an AI coding agent into installing malware.
The file was AGENTS.md, a plain-text file formatted to look like ordinary engineering notes. When the coding agent opened the Downloads folder, it read the file as instructions and attempted to install a malicious npm package called function-color. That package is part of a documented malware campaign called MALFEX — it pulls in a downloader called function-flag, which fetches and runs a Windows payload.
The attack works because two separately harmless things combine into a problem. AI coding agents are built to trust and obey instruction files in the folder they open. And a web page can save a file to the Downloads folder on its own, without a click or permission prompt, choosing the name and contents. Put together, a web page can drop a file the agent will treat as orders into a folder the agent trusts.
Researchers tested the attack against two agents. Against Codex, the malicious file told the agent to register an attacker-controlled server in ~/.codex/config.toml and install the package. Because that config file applies to every Codex session on the machine, the change would load the attacker’s server in any folder afterward, not just Downloads. Codex ran the malware in more than 90% of attempts.
Against Claude Code, the attack tried to make the agent write an ANTHROPIC_BASE_URL into a project settings file, pointing its API traffic at an attacker-controlled server. That one change leaks the session’s login token and lets the server reply as if it were the model and hand back commands the agent runs. Claude needs a person to approve writes and often refuses suspicious ones; the attack succeeded about half the time.
Why FileSure Would Have Blocked It
The malware has to write files to disk before it can run. That’s the intervention point.
FileSure operates at the Windows kernel level via a filter driver. It intercepts file operations — open, read, write, create, delete, rename — before they complete. When the malicious npm package attempts to install, it tries to write executable files (.exe, .dll) or script files (.vbs, .ps1) to disk. FileSure blocks that write if the program performing it isn’t on the authorized list.
The agent can read the instruction file. It can attempt to run the npm install command. But when the payload tries to land on disk, the write operation is intercepted and denied. The malware never executes because it never exists on the file system.
A specific FileSure rule that would stop this:
Operation: Block Create, Write
File filter: *.exe, *.dll, *.vbs, *.ps1
Program filter: Exclude authorized installers and update tools
Drive type: All local drives
Apply to: All users
This rule allows legitimate software updates from authorized programs but blocks any other program — including npm, Node.js spawned processes, or downloaded scripts — from writing executable code to disk.
FileSure would also catch the configuration file modification. The attack tries to write an attacker-controlled server address into ~/.codex/config.toml or a project’s .claude/settings.json. A second rule protecting those specific files from writes by unauthorized programs would block the persistence mechanism even if the payload somehow landed.
The researchers who documented this attack recommend not running agents in Downloads, reading instruction files before letting agents near them, and checking config files for unexpected entries. All good advice. But it assumes developers will remember to do those things every time.
Blocking unauthorized file writes at the kernel level doesn’t require remembering. The rule is active on every session, in every folder, whether the developer is paying attention or not.
Try It Yourself
Install FileSure on a test machine. Set up the rule above. Attempt to run a script that writes an executable file to disk from an unauthorized program. Watch the write get blocked and logged.
Start your free trial at bystorm.com — no credit card required, full functionality for 21 days.
Source: Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware
Category: Threat Intelligence
Tags: malfex, ai coding agents, npm malware, kernel filter driver, file system security, executable blocking, downloads folder attack
