Malicious file in Downloads folder tried to trick an AI coding agent into installing malware

Forever Security identified an AGENTS.md file in a customer’s Downloads folder that instructed an AI coding agent to install the malicious npm package function-color. The agent was stopped before any code ran. Researchers could not determine how the file reached the folder, and their tests showed that the possible attack path was not limited to one agent.