When Your AI Coding Agent Becomes the Attacker: The MALFEX AGENTS.md Prompt Injection Campaign
Executive Summary
In October 2026, security firm Forever Security uncovered a novel prompt-injection attack targeting AI coding agents such as OpenAI Codex and Anthropic Claude Code. A malicious AGENTS.md instruction file was discovered in a developer's Downloads folder, directing the AI agent to install the MALFEX-campaign npm package "function-color," which chains to a downloader and executes a Windows payload. Browsers can silently deposit files into Downloads without user interaction, meaning a single malicious webpage visit can plant attacker-controlled instructions that any subsequently launched coding agent will obey autonomously—achieving code execution or account takeover with no patch available from the AI vendors.
This incident signals a rapidly maturing class of supply-chain threat that weaponizes the trust model of agentic AI tools. As developer adoption of autonomous coding agents accelerates, adversaries are actively mapping their implicit trust boundaries—instruction files, config stores, and API endpoints—turning the agent's own obedience into the attack surface.
Why This Matters Now
Agentic AI coding tools are now deployed across tens of thousands of developer workstations, many integrated into CI/CD pipelines with broad filesystem and network permissions. The MALFEX campaign demonstrates that attackers have already operationalized prompt-injection via browser-dropped instruction files. With no vendor patch possible and half of surveyed environments running agents in writable folders, the window for enterprise exposure is open today.
Attack Path Analysis
An attacker leveraged the browser's ability to silently drop a file into a developer's Downloads folder, planting a malicious AGENTS.md instruction file that an AI coding agent would automatically trust and execute. The agent, operating without sufficient runtime policy enforcement or egress controls, installed a known-malicious npm package from an attacker-controlled registry server, establishing command-and-control and enabling credential theft, lateral movement potential, and downstream payload execution.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
A malicious web page silently dropped a crafted AGENTS.md file into the developer's ~/Downloads folder using browser-native file download behavior requiring no user interaction. The file masqueraded as routine engineering notes to deceive the AI coding agent (e.g., OpenAI Codex, Claude Code) into treating it as a trusted instruction source. This technique abuses the agent's inherent trust model for instruction files found in its working directory.
MITRE ATT&CK® Techniques
User Execution: Malicious File
Supply Chain Compromise: Compromise Software Supply Chain
Command and Scripting Interpreter: JavaScript
Browser Extensions
Phishing: Spearphishing Link
Boot or Logon Autostart Execution
Steal Web Session Cookie
Application Layer Protocol: Web Protocols
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev 5 – Malicious Code Protection / Software Integrity / Least Functionality
Control ID: SI-3, SI-7, CM-7
CISA Zero Trust Maturity Model 2.0 – Least-Privilege Application Authorization and Device Trust
Control ID: Application Pillar - Authorization / Device Pillar - Device Compliance
NIS2 Directive – Supply Chain Security and Incident Handling Measures
Control ID: Article 21 - Security of Network and Information Systems
PCI DSS 4.0 – Inventory of Bespoke and Third-Party Software / Hardware and Software Technologies Review
Control ID: Requirement 6.3.2, Requirement 12.3.4
DORA (EU Digital Operational Resilience Act) – ICT Security Controls and Third-Party Dependency Risk Management
Control ID: Article 9 - ICT Security Policies / Article 28 - ICT Third-Party Risk
ISO/IEC 27001:2022 – Vulnerability Management in Development Toolchains and Secure SDLC
Control ID: A.8.8 - Management of Technical Vulnerabilities / A.8.25 - Secure Development Life Cycle
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
AI coding agents like Codex and Claude Code face prompt injection via planted AGENTS.md files, enabling silent malicious npm package installation, config hijacking, and API token exfiltration with no patch available.
Information Technology/IT
IT environments running agentic AI workflows risk supply-chain compromise through MALFEX-linked npm packages, threatening cloud config integrity, lateral movement, and exfiltration per NIST.800-53.SC-7 and ZTMM.Data controls.
Computer/Network Security
Security teams must deploy CNSF and egress controls to detect shadow AI agent behavior, anomalous outbound traffic to attacker-controlled API endpoints, and unauthorized Downloads-folder write activity per NIST.CSF.DE.CM-7.
Financial Services
Financial sector developer environments using AI coding agents risk account takeover via stolen session tokens and malware payload execution, triggering PCI.4.0.3.5.1 and ZTMM.CrossCutting.Governance compliance violations.
Sources
- Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malwarehttps://thehackernews.com/2026/10/malicious-file-in-downloads-folder.htmlVerified
- Hijacking AI Agents via Downloads Folder - Forever Security Bloghttps://forever.security/blog/hijacking-ai-agents-via-downloads-folderVerified
- MALFEX npm Malware Campaign: Three Payloads and an Adversary That Signs Their Work - Checkmarxhttps://checkmarx.com/zero-post/malfex-npm-malware-campaign-three-payloads-and-an-adversary-that-signs-their-work/Verified
- Eight Malicious npm Packages Downloaded as Part of MALFEX Campaignhttps://thehackernews.com/2026/10/eight-malicious-npm-packages-downloaded.htmlVerified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is relevant here because the attack depended entirely on an AI coding agent making unrestricted outbound connections to attacker-controlled npm registries and API endpoints. By enforcing segmented workload boundaries and controlled egress paths, CNSF would likely reduce the attacker's ability to reach external infrastructure and propagate influence across developer environments.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: CNSF fabric-level segmentation would likely reduce the reachability of developer workstations from untrusted web origins, constraining the surface area through which attacker-controlled content could be delivered and acted upon by workload-level agents.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely constrain the privilege scope available to agent processes, reducing their ability to write to global configuration paths or escalate influence beyond the immediate working context of a single session.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement would likely reduce the attacker's ability to propagate influence laterally across projects and environments by constraining which internal paths and services a compromised agent session is permitted to reach.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility and traffic control would likely expose anomalous outbound connections to unrecognized npm registries and spoofed AI API endpoints, reducing the attacker's ability to maintain a low-profile C2 channel disguised as routine developer tooling traffic.
Control: Egress Security & Policy Enforcement
Mitigation: Egress policy enforcement would likely reduce the outbound paths available for credential and token exfiltration by constraining agent-initiated HTTPS connections to approved AI API destinations only, making rogue endpoint redirects far less likely to succeed undetected.
With earlier CNSF controls reducing attacker reachability across egress, east-west paths, and configuration scope, the residual impact would likely be narrowed — constraining payload delivery and token theft to scenarios where enforcement gaps exist, rather than enabling full workstation compromise and account takeover.
Impact at a Glance
Affected Business Functions
- AI-Assisted Software Development Pipelines
- Developer Workstation Security and Endpoint Integrity
- API Credential and Authentication Token Management
- Supply Chain and Dependency Management (npm)
Estimated downtime: 1 days
Estimated loss: N/A
Developer API session tokens (e.g., Anthropic API keys) are at risk of exfiltration through manipulated ANTHROPIC_BASE_URL redirection, enabling account takeover of AI coding assistant accounts. Sensitive source code, proprietary project files, and environment variables present in the developer workstation context may be exposed to attacker-controlled MCP or API proxy servers. In organizations where coding agents have broad filesystem or network access, the blast radius extends to internal credentials, configuration secrets, and intellectual property within any project folder the agent subsequently opens. The MALFEX-linked npm packages (function-color, function-flag) deliver a Windows payload capable of arbitrary code execution, potentially enabling lateral movement, credential harvesting, or ransomware staging on the affected developer machine.
Recommended Actions
Key Takeaways & Next Steps
- • Enforce egress security and FQDN-based policy controls (CNSF Egress Security & Policy Enforcement) to block outbound connections to unauthorized npm registries, unknown package repositories, and unrecognized API endpoints — this would have prevented function-color/function-flag C2 establishment and the rogue ANTHROPIC_BASE_URL exfiltration channel.
- • Deploy Cloud Native Security Fabric (CNSF) inline enforcement with AI-aware traffic inspection to detect anomalous agent behavior such as repeated malformed API requests, redirection of model API traffic to non-canonical endpoints, and suspicious automation patterns consistent with prompt injection attacks.
- • Apply Zero Trust Segmentation and least-privilege identity-based policy to developer workstations and CI/CD environments, ensuring AI coding agents operate within tightly scoped trust boundaries that prevent global config file writes (e.g., ~/.codex/config.toml) from being executed without explicit policy approval.
- • Leverage Multicloud Visibility & Control with centralized policy observability to baseline normal AI agent traffic patterns, enabling detection of anomalous interactions such as connections to newly registered npm packages, unexpected config mutations, or API traffic redirected to non-standard endpoints.
- • Implement Cloud Firewall (ACF) with URL filtering and outbound traffic controls on developer endpoints to block silent browser-initiated file downloads to trusted agent directories and prevent AI agent sessions from installing packages from unvetted or recently published npm sources without explicit approval.
