A malicious AGENTS.md file in your Downloads folder can hijack an AI coding agent

Security researchers at Forever Security have demonstrated that popular AI coding agents, including OpenAI Codex and Anthropic's Claude Code, can be hijacked by nothing more than a text file sitting in a user's Downloads folder, as reported by BleepingComputer. The attack requires no software vulnerability and no patch exists to fix it, because the behavior being exploited — agents automatically loading instruction files from their working directory — is working exactly as designed.

Researcher Gal Weizman told BleepingComputer the technique was first spotted on a customer's machine, where an AI agent, launched from the Downloads folder, silently attempted to install a malicious npm package called "function-color" after reading instructions from a planted file.

How the attack works

AI coding agents like Codex and Claude Code read a standard instruction file — AGENTS.md for Codex, CLAUDE.md for Claude Code — from whatever directory they're launched in, treating its contents as trusted context for the session. That behavior is a deliberate, documented feature meant to let developers give an agent project-specific guidance. The problem is that the agent doesn't distinguish between a file the developer wrote and a file that silently landed in the folder from somewhere else.

Browsers including Chrome, Edge, and Firefox save downloaded files to ~/Downloads by default, and a malicious web page can place a file there without much user interaction. If a user later launches an AI agent from that same folder — something Forever Security says customers commonly do to organize new downloads or act on files they just received — the agent will load and follow whatever instructions the planted file contains, with no warning that the file didn't come from the developer.

In testing, the researchers reproduced the attack against multiple agents. A harmless proof-of-concept payload that simply opened the calculator app succeeded in 90% of attempts against OpenAI Codex. Against Claude Code, a malicious CLAUDE.md file redirected the agent's API traffic to a researcher-controlled server, exposing the user's OAuth authentication token; tool calls executed attacker-chosen code in roughly half of test runs. Cursor CLI was also named among agents customers commonly launch from the Downloads folder, though it wasn't listed among the directly tested targets.

Why this isn't a bug either company can patch

Forever Security was blunt about the nature of the problem: "There is nothing here for OpenAI or Anthropic to patch." Loading an instructions file from the working directory is the intended design of these tools, not a flaw in their code — the vulnerability is in the assumption that whatever folder a user happens to launch an agent from is a safe, trusted workspace. Forever Security's internal telemetry shows the scale of the exposure: hundreds of its customers routinely run AI agents from the Downloads folder, and Claude Code alone has been launched from that location in more than 1,300 recorded sessions.

What to do about it

The researchers' mitigation advice is narrow but concrete: never set ~/Downloads, or any broad folder like a home directory, as an AI agent's working directory — start agents only inside a specific, known project root. Review any unfamiliar AGENTS.md, CLAUDE.md, or similar instruction file by hand before allowing an agent to act on it, keep the tools' built-in approval prompts and sandboxing enabled rather than disabling them for convenience, and treat any code an agent proposes to run on untrusted input as something to test in an isolated environment first.

The disclosure lands as AI coding agents are being adopted broadly inside engineering teams specifically because they can act autonomously on a developer's machine — which is precisely the property this attack abuses. As agent adoption grows, instruction-file poisoning joins prompt injection as a class of attack that doesn't require breaking the software at all, only exploiting how much the software is designed to trust its surroundings.