Malicious AGENTS.md files in Downloads folders can hijack AI coding agents

Researchers at Forever Security have warned that AI coding agents can be hijacked through instruction files that land in a user's Downloads folder, after finding a malicious AGENTS.md file on a customer's machine, BleepingComputer reported on October 25. The file tried to make a coding agent install a rogue npm package named function-color. Because agents automatically read instruction files from the directory they are started in, the researchers say the common habit of launching them from ~/Downloads turns every downloaded file into a potential set of commands.

What happened

According to BleepingComputer, Forever Security, a company that monitors risks from AI agents and autonomous software, discovered the malicious AGENTS.md in a customer's ~/Downloads folder. The researchers did not determine how the file got onto the machine, but the report notes that a web page could silently download such a file there, since Chrome, Edge and Firefox save downloads to that folder by default and only show a notification. BleepingComputer said Brave prompts for approval instead.

The attack only works if the user launches an agent in that folder. Researcher Gal Weizman told BleepingComputer this is common, saying Claude Code alone had launched more than 1,300 sessions from that location. The article also says customers run Cursor CLI from Downloads folders.

Technical details

Coding agents such as OpenAI Codex and Claude Code load project instruction files like AGENTS.md and CLAUDE.md automatically. BleepingComputer reports that malicious instructions in these files can make an agent run commands, install packages or change settings.

In Forever Security's tests against Codex, a reconstructed chain using a harmless payload that opened the calculator app succeeded about 90% of the time. With a malicious CLAUDE.md, the researchers redirected Claude Code's API traffic to a server they controlled, exposing the agent's OAuth token; the server could then return tool calls that executed code in roughly half of the tests. BleepingComputer said its own proof-of-concept download contained only harmless text.

Who is affected

Developers who start AI coding agents in their Downloads folder, home directory or another broad directory are most at risk. No CVE has been assigned. Forever Security said "there is nothing here for OpenAI or Anthropic to patch", and both vendors recommend running their agents from the specific project directory rather than from the home directory or a broad parent folder, according to the report.

What to do

• Never use ~/Downloads or the home directory as an AI agent's working directory; start agents only inside the relevant project folder.
• Review unfamiliar AGENTS.md, CLAUDE.md and similar instruction files before letting an agent follow them.
• Keep approval prompts and sandbox protections enabled, and do not auto-approve package installs or shell commands.
• Test untrusted code and repositories in an isolated environment, and consider configuring the browser to ask where to save downloads.