Malicious Markdown instruction file attempts to trick Codex into installing a malicious package; AI coding agents face attack risk

Security vendor Forever Security disclosed an attack incident targeting AI coding agents. Researchers found a malicious AGENTS.md file in a customer computer's Downloads folder; the attacker attempted to trick OpenAI Codex into changing settings and installing a malicious NPM package named function-color, and the installation was blocked by the security protection system. The file asked Codex to change machine-wide settings, register an attacker-specified MCP server and use its startup command to install the malicious package, while also attempting to bypass operation approval and sandbox restrictions; researchers reproduced the attack in an isolated environment, and more than 90% of tests successfully tricked Codex into executing the attack instructions. Tests against Anthropic Claude Code showed that a malicious CLAUDE.md could trick the agent into changing API connection settings and cause OAuth token leakage, and about 50% of tests successfully changed the relevant settings.