Hackers exploit AI coding assistants to execute malicious commands

The threat targets tools like OpenAI’s Codex and Anthropic’s Claude Code, which are designed to follow project-specific directives found in files like AGENTS.md or CLAUDE.md. While these files typically guide an assistant on project standards or font choices, attackers can plant their own instructions to force the software to download and execute malicious packages. In the case documented by Forever, the assistant was instructed to install 'function-color,' a component associated with the MALFEX malware campaign.

Researchers demonstrated that once the assistant processes the malicious file, it may modify system settings to ensure the attacker’s server loads at startup. This persistence means the threat remains active even after the user exits the original directory. Further testing revealed that similar tactics against Claude Code could redirect traffic to attacker-controlled servers, exposing login tokens and granting remote command execution capabilities. To mitigate these risks, security experts advise keeping coding assistants away from Downloads folders, verifying all configuration files before use, and enforcing strict approval requirements for any actions taken by automated agents.