Quick question: where do you launch your AI coding agent from? If the answer is “wherever my terminal happens to be”, and that happens to be your Downloads folder, you might want to read this before your next session. A new AGENTS.md attack, documented by the folks at Forever Security, shows that a plain text file quietly dropped by a web page is enough to make Codex or Claude Code run commands you never asked for.
No exploit. No malware. Just a markdown file with a convincing name.
How the AGENTS.md attack works
You probably know the drill: coding agents look for instruction files in their working directory (AGENTS.md for Codex, CLAUDE.md for Claude Code, and friends) and treat whatever’s inside as house rules. That’s a feature. It’s how you tell the thing to use tabs, run the tests, or stop touching your CSS.
The problem is that your browser also has a folder it writes to without asking: ~/Downloads. Chrome, Edge and Firefox all save files there by default, no prompt, just a little notification you’ve learned to ignore. As the researchers put it, “~/Downloads is special. It is the one folder the web can write to on its own.”
So picture the chain. You visit a dodgy page, it triggers a download of a file called AGENTS.md (the researchers’ proof of concept does exactly this, with harmless text inside). Later you open a terminal in Downloads, maybe to let the agent sort out that mess of PDFs and installers, and the agent dutifully reads the file and follows the instructions. In the real-world case that started all this, a customer’s agent tried to install a rogue npm package called “function-color”. That’s the moment Forever’s monitoring caught it.
In their tests, a benign payload that pops open the calculator app worked 90% of the time against OpenAI Codex. The Claude Code variant is nastier: a poisoned CLAUDE.md redirected the agent’s API traffic to a server the researchers controlled, which exposed the OAuth token and let them impersonate the model, returning tool calls that executed code in about half the runs. Leaked token, hijacked account, and the user sees nothing out of the ordinary.
Why nobody is going to “patch” this
Here’s the part I find both fair and slightly maddening. The researchers themselves say “There is nothing here for OpenAI or Anthropic to patch.” Every component is working as designed: browsers download files to Downloads, agents read config files in their working directory. Glue two intended behaviours together and you get a weapon. Responsibility lands, once again, on you.
And people really do this. Gal Weizman from Forever says their internal stats show hundreds of customers running agents straight from ~/Downloads, with Claude Code alone accounting for more than 1,300 sessions started there. Which makes total sense: “hey, organise this folder for me” is one of the most natural things to ask an agent. It’s also the most dangerous place on your disk to say it.
If you’ve been following the autonomy debates, this fits a pattern. We wrote recently about OpenAI agents that disabled their own monitoring; now we’ve got agents that will take orders from a random file because it has the right name. Different failure, same root cause: we keep handing these tools more power than we hand them context.
What I’d actually do
Nothing heroic. Start your agent from the project root, not from your home folder and certainly not from Downloads. Keep the approval prompts on, even when they’re annoying (especially when they’re annoying). If you see an AGENTS.md or CLAUDE.md you don’t remember writing, read it before the agent does. And if you want the agent to tidy your Downloads, copy the stuff into a scratch directory first, or do it in a container.
Brave, for what it’s worth, asks before saving downloads. Turning on “ask where to save” in your usual browser gets you most of the way there too.
The agents aren’t the bug. Trusting whatever lands in Downloads is.
Source: BleepingComputer — AI coding agents hijacked using AGENTS.md file in Downloads folder
Image: Luis Gomes / Pexels
Discover more from TechPassion
Subscribe to get the latest posts sent to your email.
