> ## Content Index
> Fetch the complete content index at: https://blog.harshkohli.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# AGENTS.md in Downloads Can Hijack AI Coding Agents
- URL: https://blog.harshkohli.com/agents-md-downloads-folder-ai-agent-hijack/
- Published: 2026-10-25T21:03:15.000Z
- Updated: 2026-10-25T21:03:15.000Z
- Description: A planted AGENTS.md in your Downloads folder can steer Codex or Claude Code into installing malware. How the attack works and how to stay safe.
- Author: Harsh Kohli
- Tags: Tech News, AI

Here's a habit I didn't think twice about until today: opening an AI coding agent inside the Downloads folder to sort files or poke at something I'd just grabbed. A security firm says attackers are already exploiting that habit, with nothing more than a plain Markdown file. [BleepingComputer flagged the research on X](https://x.com/BleepinComputer/status/2114383958028750884?ref=blog.harshkohli.com).

## What happened

[Forever Security says](https://forever.security/blog/hijacking-ai-agents-via-downloads-folder/?ref=blog.harshkohli.com) it caught a coding agent on a customer's computer trying to install a malicious npm package called `function-color`. The order came from an `AGENTS.md` file sitting in that person's `~/Downloads` folder, which was also the agent's working directory. The file was dressed up as normal engineering guidelines.

Agents like OpenAI Codex and Claude Code read instruction files such as `AGENTS.md` or `CLAUDE.md` from the folder they start in, then follow them. Forever couldn't work out how the file got onto the machine. Its theory is that Downloads is the one folder a web page can write to by itself, since Chrome, Edge and Firefox save downloads there by default without asking. [BleepingComputer tested Forever's demo page](https://www.bleepingcomputer.com/news/security/ai-coding-agents-hijacked-using-agentsmd-file-in-downloads-folder/?ref=blog.harshkohli.com) and confirmed it dropped a harmless `AGENTS.md` into Downloads.

Forever then ran the attacker's real file against Codex in an isolated VM. It reports that Codex added a new tool server to its global config at `~/.codex/config.toml` and installed the package in more than 90% of tries. Because that config is machine-wide, every later Codex session would load the attacker's server, in any folder.

Claude Code was harder to fool. Forever wrote its own `CLAUDE.md` that got Claude to send its API traffic to a server the researchers controlled. That leaked the OAuth token and let the fake server reply with commands, which worked about half the time. Forever hasn't published attempt counts or the exact versions it tested, so treat those percentages as its own lab numbers.

## Why it matters

There's no bug for OpenAI or Anthropic to patch here, and Forever says so itself. The agent is doing what it was built to do. The problem is trusting a folder the web can write to. Forever also says about half of its customers run a coding agent inside Downloads, which tells me plenty of people are exposed.

It's the same lesson as the [LiteLLM attack](https://blog.harshkohli.com/litellm-attack-leaked-master-key/) from a few days ago: AI developer tools hold powerful tokens, and attackers are going after them.

## What to do

- Don't start Codex, Claude Code, Cursor's CLI or any other agent in Downloads, your home folder or another broad folder. Start it in the project folder you actually want it working on.
- Read any `AGENTS.md` or `CLAUDE.md` you didn't write before letting an agent work there, including in freshly cloned repos.
- Check `~/.codex/config.toml` for MCP server entries you don't recognise, and your Claude settings files for an `ANTHROPIC_BASE_URL` or proxy you didn't set.
- Keep approval prompts and sandboxing switched on, and be suspicious of any instruction asking the agent to bypass them.
- Set your browser to ask where to save each download. It's a small hassle that closes the silent-drop route.
- If `function-color` ever turns up in your installs, treat the machine as compromised and rotate your tokens. Deleting the Markdown file won't undo config changes.

If you run models on your own PC, my [LM Studio guide](https://blog.harshkohli.com/run-deepseek-llama-locally-lm-studio-windows/) keeps everything local, but the same rule applies: know which folder your tools are reading.