AI Coding Agents Exposed to Hijack via Malicious Markdown Files

"~/Downloads is special. It is the one folder the web can write to on its own," Forever Security wrote, warning that "a web page can download a file named AGENTS.md into your Downloads folder, silently."

Forever Security's discovery and how AGENTS.md files instruct agents

Researchers at Forever Security found a malicious AGENTS.md markdown instruction file on a customer’s machine that caused an AI coding agent to attempt installing a rogue npm package named "function-color." AGENTS.md and similar markdown files are plain-text project instruction files used by AI coding agents to learn tools, run tests, and follow coding conventions. Although these files are not executables, the company’s report shows that malicious text inside them can direct an agent to run commands, install packages, or change settings using whatever tools and permissions the agent has.

Why the Downloads folder is a unique attack vector

The investigation traced the agent’s attempted installation back to an AGENTS.md file in the customer’s ~/Downloads folder, which also served as the agent’s working directory. Forever Security and BleepingComputer explain that many popular browsers — Chrome, Edge, and Firefox — save web downloads to the user’s ~/Downloads directory by default and display download notifications, while other browsers such as Brave prompt the user for approval. The researchers created a proof-of-concept (PoC) web page that dropped an AGENTS.md file into ~/Downloads; when BleepingComputer visited that page it downloaded an AGENTS.md file containing harmless placeholder strings.

Reproduced attacks against OpenAI Codex and Claude Code; measured success rates

Forever Security reproduced the attack against OpenAI Codex and demonstrated a related technique against Claude Code. In tests against Codex the researchers used a harmless payload that opened the calculator application and recorded a 90% success rate. Against Claude Code they showed how a malicious CLAUDE.md file could redirect the agent’s API traffic to a server under attacker control, exposing the agent’s OAuth token; that server could then impersonate the model and return tool calls that executed code in roughly 50% of tests. The report emphasizes that these are attacks built from the interaction of intended browser behavior and agent behavior: agents automatically load applicable files from their working directory and use contained instructions to guide actions.

Vendor guidance and practical mitigations

Forever Security and the vendors referenced recommend limiting an agent’s working directory to the specific project it should operate on. OpenAI and Anthropic advise starting AI coding agents in the root of the particular project rather than in a home or broad parent directory, keeping the working area as narrow as practical and expanding access only when necessary. Users should review unfamiliar AGENTS.md, CLAUDE.md, and similar instruction files before allowing agents to follow them, keep approval prompts and sandbox protections enabled, and test potentially untrusted code in isolated environments before running it on main systems.

What this means for technologists, end users, and adversaries

• Technologists and security teams: Audit how AI coding agents are invoked in automation and developer workflows. The report shows an operational vulnerability where the working directory defines an agent’s default project context and, depending on the tool, can establish its filesystem access boundary.
• End users and developers: Avoid launching agents from ~/Downloads and instead start them in the intended project directory; review any AGENTS.md or CLAUDE.md file before allowing execution and enable prompts and sandboxing features.
• Adversaries and red teams: The tests demonstrate an exploitable chain that can be triggered with only a dropped instruction file plus a subsequent agent launch in that directory; the demonstrated outcomes included package installation, arbitrary command execution, and credential exfiltration.

The core of the finding is simple and unsettling: an instruction file a user never intentionally opened can contain steps an agent will faithfully follow if the agent is started in the same directory. Forever Security framed the responsibility as ultimately belonging to the user’s configuration choices, noting that "there is nothing here for OpenAI or Anthropic to patch" because "an agent that follows the AGENTS.md in its folder is doing exactly what it was built to do." The Blue Report 2026 cited in the materials also underscores that once attackers possess valid credentials, "prevention drops sharply" — a reminder that initial access can produce outsized downstream impact.

For now the clearest, immediate defenses are concrete: do not run agents from broad directories like ~/Downloads, inspect any instruction file encountered there, and keep agent scopes narrow. The field test numbers — 90% for the Codex calculator PoC and roughly 50% for Claude Code token-exfiltration tests — make the risk more than theoretical. The single practical question left by these facts: will tool users reconfigure how and where they run agents before one of these chains is used in a live compromise?

Original BleepingComputer story