Researchers found a malicious AGENTS markdown instruction file in a customer’s Downloads folder that tricked an AI coding agent into installing a rogue npm package.
They reproduced the attack against OpenAI Codex and demonstrated a related technique against Claude Code to leak OAuth tokens and hijack the account using only the malicious instructions.
Markdown files such as AGENTS.md are plain-text files that contain project-specific instructions for AI coding agents, such as the tools to use, how to run tests, and the coding conventions to follow.
Agents following malicious instructions
Researchers at Forever Security, a company that monitors for risks introduced by AI agents and autonomous software, discovered the tactic on a customer’s computer, where a coding agent attempted to install the malicious npm package ‘function-color.’
The investigation traced the AI agent’s attempt to install a malicious npm package to an AGENTS.md file in the customer’s ~/Downloads folder, which also served as the agent’s working directory.
Agents automatically load applicable files from their working directory and use the contained instructions to guide their actions.
While these files aren’t executables, malicious instructions contained in them can lead to AI agents running commands, installing packages, or changing settings using the tools and permissions available to it.
“There is nothing here for OpenAI or Anthropic to patch. An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do,” the researchers say.
The researchers’ test confirmed that an attacker could use such a file to manipulate OpenAI Codex and Claude Code into executing code or stealing credentials.
Although the researchers could not determine how the malicious instructions file landed into the target’s ~/Downloads location, they explained to BleepingComputer that simply visiting a malicious page could drop a payload without any user interaction.
In a report this week, Forever Security says that “~/Downloads is special. It is the one folder the web can write to on its own,” and that “a web page can download a file named AGENTS.md into your Downloads folder, silently.”
The researchers created a proof-of-concept (PoC) to demonstrate how the attack could land a malicious file into the ~/Downloads location without the user noticing.
When BleepingComputer verified the PoC page, it downloaded an AGENTS.md file containing harmless content, namely the strings “sensitive data here” and “line 2.”
By default, many popular browsers, including Chrome, Edge, and Firefox, save files downloaded from the web to the user’s ~/Downloads directory without prompting them to choose a save location for each download.
BleepingComputer’s tests in other browsers, such as Brave, prompted the user to approve the download, which should be enough to alert the user that a file was downloaded.
However, Chrome, Edge, and Firefox display download notifications by default, alerting users when a file has been saved locally.
After dropping the file into Downloads, the attack would require the target to launch their AI agent in that same directory so it could load the instruction file and digest its malicious instructions.
Forever researcher Gal Weizman told BleepingComputer that this is common practice, as people often use AI agents to organize that folder or to act on a newly downloaded file.
Weizman says that internal statistics show that hundreds of customers run AI agents, including Claude Code, OpenAI Codex, and Cursor CLI, from their ~/Downloads folders. Claude Code alone launched more than 1,300 sessions from that location, the researcher told BleepingComputer.
Tests show attack feasible
The researchers tested their reconstructed attack chain against Codex using a harmless payload that simply opened the calculator app, recording a 90% success rate.
In a separate test, they used a malicious CLAUDE.md file to redirect Claude Code’s API traffic to a server they controlled. This exposed the agent’s OAuth token, allowing the server to impersonate the model and return tool calls that executed code in roughly 50% of tests.
The researchers say that the risk is a combination of intended browser and agent behavior, which puts the precaution and defense responsibility directly on the user.
Users should avoid setting ~/Downloads as an AI coding agent’s working directory because the location may contain untrusted files that the agent could interpret as instructions.
OpenAI and Anthropic recommend running their AI coding agents from the project directory they are intended to work on.
Keeping the working directory scoped to the relevant project helps provide the agent with appropriate context and limits its working scope, reducing the risk of it processing untrusted files in unrelated locations.
The common recommendation from OpenAI and Anthropic is to start an AI coding agent in the root of the specific project it should work on, rather than in your home directory or a broad parent directory. Keep its working area as narrow as practical, and expand access only when needed.
The key idea is that the working directory defines the agent’s default project context and, depending on the tool, helps establish its filesystem access boundary.
Users should review unfamiliar AGENTS.md, CLAUDE.md, and similar instruction files before allowing an AI coding agent to follow them, keep approval prompts and sandbox protections enabled, and test potentially untrusted code in an isolated environment before running it on their main system.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
