AGENTS.md file in Downloads folder hijacks AI coding agents

Researchers at Forever Security, a firm that watches for risks introduced by AI agents, found a malicious AGENTS.md file on a customer's computer. Because of it, an AI coding agent tried to install a rogue npm package called function-color.

Files like AGENTS.md or CLAUDE.md are plain text holding instructions for AI agents: which tools to use, how to run tests, which coding conventions to follow. Agents automatically load such files from their working directory and act on what they contain.

The agent does exactly what it was built to do

The files aren't executables, but the instructions inside can lead an agent to install packages, change settings, or run code within the permissions it has. There is nothing to patch, the researchers argue: "An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do."

The decisive detail was the location — ~/Downloads, which doubled as the agent's working directory. The researchers call that folder special: it is the one directory the web can write to on its own. Simply visiting a malicious page can silently drop a file named AGENTS.md there with no user interaction.

How browsers help the attack

By default Chrome, Edge, and Firefox save downloads to ~/Downloads without asking where to put them — though they do show a download notification. Brave, by contrast, prompts for approval, which is itself a warning sign. In the proof-of-concept, the dropped file held harmless strings like "sensitive data here."

The attack then needs the victim to launch the agent in that same folder. That, the researchers note, is common: people often use agents to tidy up Downloads or to act on a freshly downloaded file. Company figures show hundreds of customers run Claude Code, OpenAI Codex, and Cursor CLI from ~/Downloads — Claude Code alone accounted for more than 1,300 sessions from that location.

Tested and feasible

Against Codex, a harmless payload that merely opened the calculator app succeeded in 90% of runs. In a separate test, a malicious CLAUDE.md redirected Claude Code's traffic to a server the researchers controlled, exposing the agent's OAuth token; that let them impersonate the model and execute code in roughly half of the attempts.

The risk stems from intended browser and agent behavior, so the burden falls on users. OpenAI and Anthropic advise launching agents from the root of the specific project rather than the home directory or ~/Downloads, keeping the working scope as narrow as possible, reviewing unfamiliar instruction files, keeping approval prompts and sandboxing enabled, and testing untrusted code in isolation.

Source: Bleeping Computer