Malicious AGENTS.md Files in Downloads Folder Used to Hijack AI Coding Agents

Security researchers at Forever Security have documented a real-world attack in which a malicious AGENTS.md markdown file inside a customer's ~/Downloads directory tricked an AI coding agent into attempting to install a rogue npm package named function-color.

Following the incident investigation, the researchers reproduced the attack vector against OpenAI Codex and demonstrated a related instruction-file technique using CLAUDE.md against Anthropic's Claude Code to leak OAuth tokens and execute arbitrary tool calls.

How Instruction Files Become an Attack Surface

Markdown configuration files such as AGENTS.md and CLAUDE.md are plain-text files designed to give AI coding agents project-specific instructions, such as build commands, test runners, and coding conventions. When an AI coding agent is launched in a directory, it automatically loads applicable instruction files from its working directory to guide its actions.

In the incident investigated by Forever Security, the customer's ~/Downloads directory was serving as the AI coding agent's working directory. Because the agent treated the untrusted AGENTS.md file in ~/Downloads as authoritative project guidance, it attempted to install the malicious function-color package using the tools and permissions available to the session.

"There is nothing here for OpenAI or Anthropic to patch. An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do," the Forever Security researchers noted in their report.

Silent Browser Downloads Meet Broad Working Directories

While the researchers could not determine the exact website that delivered the file in the customer incident, they demonstrated in a proof-of-concept that visiting a web page can silently drop an AGENTS.md file into ~/Downloads.

By default, major browsers including Google Chrome, Microsoft Edge, and Mozilla Firefox save downloaded files directly into ~/Downloads without prompting the user to select a folder for each file, though they display a download notification. In testing by BleepingComputer, browsers such as Brave prompted the user to approve the download before saving.

Forever Security researcher Gal Weizman told BleepingComputer that running coding agents inside ~/Downloads is a widespread habit among users who ask AI agents to organize downloaded files or inspect newly downloaded archives. According to Forever Security's internal telemetry across hundreds of customer environments using Claude Code, OpenAI Codex, and Cursor CLI, Claude Code alone launched more than 1,300 sessions directly from the ~/Downloads folder.

Reconstructed Attack Results and Mitigations

In controlled testing, Forever Security evaluated the reconstructed attack chain against OpenAI Codex using a benign payload that opened the system calculator application, recording a 90% success rate.

In a separate test targeting Claude Code, the researchers used a malicious CLAUDE.md file to redirect the agent's API traffic to a researcher-controlled server. That redirection exposed the agent's OAuth token, enabling the server to impersonate the model and return tool calls that executed code in roughly 50% of test runs.

Both OpenAI and Anthropic advise developers to launch AI coding agents only from the specific project root directory they intend to work on, rather than broad parent directories such as a home folder or ~/Downloads. Users are also advised to inspect unfamiliar AGENTS.md and CLAUDE.md files before starting an agent session and to keep command-approval prompts and sandbox boundaries enabled.