Malicious file in Downloads folder attempts to trick AI coding agent into installing malware

Security company Forever Security reported that it found a malicious AGENTS.md file in a real customer's Downloads folder; it was disguised as engineering notes and attempted to trick an AI coding agent into installing the known malicious npm package function-color. The company intercepted the attempt before the code ran; the package belongs to the MALFEX malware campaign named by CloudSEK and Checkmarx. The attack relies on two points: the agent trusts instruction files in the folder it opens, and a webpage can silently write a file with a specified name and content to the Downloads folder without a click or permission prompt; Forever reproduced the silent delivery path with a proof-of-concept page, but could not confirm whether the real attack went through this path. Forever believes OpenAI and Anthropic do not need to patch, and recommends not launching agents in ~/Downloads, checking unknown instruction files and configuration changes, and keeping approval prompts and sandboxes.