A security firm caught a live attack in which a plain text file sitting in an employee's Downloads folder told their AI coding agent to install a malicious npm package. The agent obeyed, because reading that file is precisely what it was built to do.
What happened
Forever Security published the finding on 22 October after its monitoring blocked an attempt to install function-color, a package tied to the MALFEX npm campaign, on a real customer's machine. The instruction came from an AGENTS.md file in the Downloads folder, which was also the directory the agent had been opened in.
The 13 KB file read like ordinary engineering notes. Near the end it presented an install step as routine environment setup, asking the agent to register a server in the Codex configuration file and pull the package. That configuration applies to every Codex session on the machine, so the change would follow the user into later projects, not just that folder.
The researchers reproduced it in an isolated virtual machine: Codex ran the planted commands in more than 90% of attempts. Against Claude Code they wrote a CLAUDE.md that pointed the session at their own API endpoint, exposing the login token and letting them answer as the model and issue commands of their own. That worked in about half of tests.
The two behaviours that make it work are both normal. An agent trusts the instruction file in the folder it opens, and a web page can save a file into Downloads without a click or a permission prompt. Neither OpenAI nor Anthropic has anything to patch.
Who is affected
- Teams that run Codex, Claude Code or a similar agent from Downloads or the home folder. Forever says about half of its customers do this, and that it saw more than 1,300 Claude Code sessions launched from Downloads.
- Machines where the npm package function-color was installed. npm replaced it with a placeholder version on 7 October 2026, after roughly two years of availability.
- Codex users carrying a server block in their global configuration, and Claude Code projects with an API endpoint nobody on the team set.
- Anyone who clones a repository and lets an agent run before reading the instruction files that came with it.
What to do now
Stop starting coding agents in Downloads, and read every AGENTS.md or CLAUDE.md you did not write before an agent touches it.
- Check the Codex configuration for a server entry or changed base URL you did not add.
- Check each project's Claude settings for an unfamiliar API address.
- Keep approval prompts and sandboxing switched on, and treat any instruction file that asks to disable them as hostile.
- If a planted file turns up, rotate the agent's login token. A stolen token is a live session, not a single blocked request.
What this means for South African businesses
This one does not need a formal AI programme to bite: a single developer with a browser and an agent habit is sufficient exposure, and there is no vendor patch to wait for. Most local development teams I see have adopted these tools faster than they have written any rule about where they may start them, which is exactly the gap being exploited. The practical control is a folder and a file review, not a purchase.
Source: Forever Security - Markdown Is the New Executable, published 22 October 2026.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.