Your Downloads folder probably contains a few PDFs, forgotten screenshots, and several files named some variation of "final." But according to a recent report by security company Forever, it could also contain instructions telling your AI assistant to install malware.

In an Oct. 22 blog post, the company reported that they caught an AI coding assistant following those instructions on a customer's computer. The company blocked the installation, then traced the request to a text file in Downloads.

How does a text file get that kind of power? Tools like OpenAI's Codex and Anthropic's Claude Code can, depending on their permissions, edit files, run commands, and install software. Developers leave them instruction files called AGENTS.md or CLAUDE.md to explain how to work on a project. If you're building a website, those notes might tell the assistant which fonts to use or what to test before finishing.

An attacker can leave instructions, too. In this case, the file told the assistant to install "function-color," a software package linked to the MALFEX malware campaign documented by Checkmarx.

Forever didn’t establish how the file reached the customer's computer, but its researchers demonstrated one possible route. Depending on browser settings, a website can drop a file into Downloads without asking for approval. If someone then launches their coding assistant in that folder, it could read the file and follow its orders.

When Forever tested the customer's file on an isolated computer, it said Codex downloaded and ran the malware. It also changed settings that could make the attacker’s software load in later sessions.

Source link