AGENTS.md in Downloads Can Hijack AI Coding Agents

Here's a habit I didn't think twice about until today: opening an AI coding agent inside the Downloads folder to sort files or poke at something I'd just grabbed. A security firm says attackers are already exploiting that habit, with nothing more than a plain Markdown file. BleepingComputer flagged the research on X.

What happened

Forever Security says it caught a coding agent on a customer's computer trying to install a malicious npm package called function-color. The order came from an AGENTS.md file sitting in that person's ~/Downloads folder, which was also the agent's working directory. The file was dressed up as normal engineering guidelines.

Agents like OpenAI Codex and Claude Code read instruction files such as AGENTS.md or CLAUDE.md from the folder they start in, then follow them. Forever couldn't work out how the file got onto the machine. Its theory is that Downloads is the one folder a web page can write to by itself, since Chrome, Edge and Firefox save downloads there by default without asking. BleepingComputer tested Forever's demo page and confirmed it dropped a harmless AGENTS.md into Downloads.

Forever then ran the attacker's real file against Codex in an isolated VM. It reports that Codex added a new tool server to its global config at ~/.codex/config.toml and installed the package in more than 90% of tries. Because that config is machine-wide, every later Codex session would load the attacker's server, in any folder.

Claude Code was harder to fool. Forever wrote its own CLAUDE.md that got Claude to send its API traffic to a server the researchers controlled. That leaked the OAuth token and let the fake server reply with commands, which worked about half the time. Forever hasn't published attempt counts or the exact versions it tested, so treat those percentages as its own lab numbers.

Why it matters

There's no bug for OpenAI or Anthropic to patch here, and Forever says so itself. The agent is doing what it was built to do. The problem is trusting a folder the web can write to. Forever also says about half of its customers run a coding agent inside Downloads, which tells me plenty of people are exposed.

It's the same lesson as the LiteLLM attack from a few days ago: AI developer tools hold powerful tokens, and attackers are going after them.

What to do

• Don't start Codex, Claude Code, Cursor's CLI or any other agent in Downloads, your home folder or another broad folder. Start it in the project folder you actually want it working on.
• Read any AGENTS.md or CLAUDE.md you didn't write before letting an agent work there, including in freshly cloned repos.
• Check ~/.codex/config.toml for MCP server entries you don't recognise, and your Claude settings files for an ANTHROPIC_BASE_URL or proxy you didn't set.
• Keep approval prompts and sandboxing switched on, and be suspicious of any instruction asking the agent to bypass them.
• Set your browser to ask where to save each download. It's a small hassle that closes the silent-drop route.
• If function-color ever turns up in your installs, treat the machine as compromised and rotate your tokens. Deleting the Markdown file won't undo config changes.

If you run models on your own PC, my LM Studio guide keeps everything local, but the same rule applies: know which folder your tools are reading.