Malicious AGENTS.md File Steers Codex Into Installing Malware in Over 90% of Tests

Forever Security found a plain-text AGENTS.md file in a developer's Downloads folder. It tried to coerce a coding agent into installing a known malicious npm package that belongs to the MALFEX chain. The attack works because agents trust instruction files in their working directory, and browsers save downloads to the same place. According to The Hacker News, Codex executed the npm malware in over 90% of attempts. A related Claude Code variant leaked OAuth tokens. The recommended mitigations are to avoid running coding agents from the Downloads folder and to audit stray AGENTS.md and CLAUDE.md files. For teams shipping agent products, instruction files are an execution surface, not documentation. Sandboxing agent workspaces, restricting shell and package installs, and reviewing repository-level instruction files should be part of the default setup before agents touch developer machines.