AGENTS.md Auto-Download Hijacks Codex to Install MALFEX npm Payload

The file instructed the agent to treat a Downloads folder as a project root, add an attacker-controlled MCP server, and pull the function-color package. That package chains into function-flag and a Windows executable, matching the MALFEX campaign previously mapped by CloudSEK and Checkmarx. The vector combined two design choices: agents obey folder-level instruction files by default, and browsers permit silent writes to Downloads without user gesture.

Forever Security reproduced the attack on both Codex and Claude Code. Codex accepted the config change persistently across sessions; Claude required an approval step that succeeded roughly half the time when framed as engineering notes. No product-level patch exists because the behavior matches intended agent operation. The firm could not confirm the initial drop vector on the customer machine.

This pattern extends earlier prompt-injection work against autonomous agents. Supply-chain abuse via npm now gains a low-friction delivery path once any coding agent scans the default download directory. Procurement records and job postings at defense contractors already show rising internal use of similar agents, increasing the blast radius if the same folder trust is replicated.

Next steps include restricting agent start directories, scanning for unexpected AGENTS.md or CLAUDE.md files, and monitoring config.toml and .claude/settings.json for unauthorized base URLs. Adoption of explicit allow-lists for instruction files will determine whether the technique scales or remains an edge case.