Researchers at Forever Security have found that malicious AGENTS.md and similar instruction files can hijack AI coding agents when the files are placed in a user’s downloads folder. The researchers recreated the attack against OpenAI Codex and demonstrated related techniques against Claude Code, including installing malicious npm packages, executing code, leaking OAuth tokens and potentially taking over accounts—all through instructions supplied to the agents.
Markdown files such as AGENTS.md are plain-text documents that provide project-specific guidance to AI coding agents, including which tools to use, how to run tests and which coding conventions to follow.
How the attack works
Forever Security, a company that monitors risks associated with AI agents and autonomous software, investigated an attempt to use an AGENTS.md file in a customer’s ~/Downloads folder to make an AI coding agent install a malicious npm package. The folder was also being used as the agent’s working directory.
AI agents typically load relevant instruction files from their working directory and use them to guide their actions. Although Markdown files are not executable, their instructions can prompt an agent to run commands, install packages or change settings using the tools and permissions available to it.
“There’s nothing here to patch OpenAI or Anthropic. The agents that follow AGENTS.md in the folder are doing exactly what they were built to do,” the researchers said.
The researchers’ tests confirmed that attackers can use these files to manipulate OpenAI Codex and Claude Code into executing code or stealing credentials.
They could not determine how the malicious instruction file reached the target’s ~/Downloads folder. However, they told BleepingComputer that merely visiting a malicious webpage could cause a file to be downloaded without further user interaction.
“~/Downloads is special; it’s the one folder that the web can write to on its own,” Forever Security said in a report this week. “Web pages can silently download files named AGENTS.md to the Downloads folder.”
To demonstrate the technique, the researchers created a proof-of-concept attack that attempts to place a file in the ~/Downloads folder without the user’s knowledge.
When BleepingComputer tested the proof-of-concept page, it downloaded an AGENTS.md file containing the benign text “Sensitive Data Here” and “Line 2.”
Many popular browsers, including Chrome, Edge and Firefox, save downloaded files to ~/Downloads by default without asking users to select a location each time. In BleepingComputer’s tests, browsers such as Brave prompted users to approve the download, which could alert them that a file was being saved. Chrome, Edge and Firefox also display download notifications by default.
Once the file is in the downloads folder, the attack still requires the victim to launch an AI agent from that directory. The agent then loads the instruction file and processes its malicious content.
Forever Security researcher Gal Weizman told BleepingComputer that this situation is common because people often use AI agents to organize folders and manipulate newly downloaded files.
According to the company’s internal statistics, hundreds of customers run AI agents such as Claude Code, OpenAI Codex and Cursor CLI from their ~/Downloads folders. The researchers told BleepingComputer that Claude Code alone had started more than 1,300 sessions from that location.
Tests demonstrate the risk
The researchers reconstructed the attack chain against Codex using a benign payload that simply opened a calculator application. The test achieved a 90% success rate.
In a separate test, they used a malicious CLAUDE.md file to redirect Claude Code’s API traffic to a server under their control. This exposed the agent’s OAuth token, allowing the server to impersonate the model and return tool calls that executed code in approximately 50% of the tests.
How users can reduce the risk
The researchers said the risk results from the intended behavior of both browsers and AI agents, making prevention and protection largely a user responsibility.
Users should avoid setting ~/Downloads as the working directory for an AI coding agent, because the folder may contain untrusted files that the agent could interpret as instructions.
OpenAI and Anthropic recommend running AI coding agents from the specific project directory being worked on. Starting the agent at the project’s root, rather than in the home directory or a broader parent directory, provides relevant context while limiting the files it can process.
The working directory defines the agent’s default project context and, depending on the tool, can also help establish boundaries for filesystem access. Users should keep that area as small as possible and expand access only when necessary.
Users should also review unfamiliar AGENTS.md, CLAUDE.md and similar instruction files before allowing an AI coding agent to follow them. Approval prompts and sandbox protections should remain enabled, and potentially untrusted code should be tested in an isolated environment before it is run on a primary system.
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.
The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com