AI coding agents hijacked using AGENTS.md file in Downloads folder

Security researchers at Forever Security uncovered an attack vector where an untrusted markdown file inside a user folder manipulates automated developer tools. As reported in BleepingComputer's report, investigators found a coding agent attempting to install a rogue npm package named function-color. The agent read instructions from an AGENTS.md document located in ~/Downloads, its working directory. Tests confirmed that similar instructions manipulate OpenAI Codex and leak credentials from Claude Code.

This report details how background file downloads interact with local instruction processing across modern developer environments, examining reproduction chains demonstrated across commercial tools. The analysis is structured for engineers, security leads, and technical teams who deploy terminal agents including Claude Code, OpenAI Codex, and Cursor CLI. Readers will examine contextual markdown execution, browser download habits that leave intake folders exposed, laboratory compromise rates, and operational isolation steps.

AI coding agents hijacked using AGENTS.md: what actually changed

Researchers at Forever Security discovered that an autonomous assistant on a customer computer attempted to install a rogue npm package called function-color. Rather than exploiting software vulnerabilities, the incident stemmed from a plain-text AGENTS.md instruction file located in the user's ~/Downloads directory. Developer tools rely on markdown files like AGENTS.md to set project guidelines, coding conventions, and tool configurations. Because the assistant was launched inside ~/Downloads, it parsed the file as legitimate project context and prepared to execute instructions using its normal agent permissions.

This technique exposes an operational hazard where untrusted web content controls autonomous tools that possess shell access. While instruction files are non-executable text documents, their directives prompt agents to run terminal commands, modify configurations, or install external software. Forever Security observed that neither OpenAI nor Anthropic can patch this behavior because an agent that follows the AGENTS.md in its folder is doing exactly what it was built to do. The trust boundary has therefore shifted away from software binaries and toward strict working directory selection.

AI coding agents hijacked using AGENTS.md: how it works

The attack leverages browser file handling alongside automatic workspace scanning performed by coding assistants. Web browsers including Google Chrome, Microsoft Edge, and Mozilla Firefox save downloaded files into ~/Downloads without prompting users to choose a location. Forever Security noted that ~/Downloads is special because a web page can download a file named AGENTS.md into your Downloads folder, silently. In a verified proof-of-concept test, visiting a webpage downloaded an AGENTS.md file containing the strings sensitive data here and line 2, proving that untrusted sites can plant instruction files silently.

Execution occurs once a developer opens a terminal inside ~/Downloads and starts an AI agent. In tests against OpenAI Codex, researchers used an AGENTS.md file to trigger the system calculator application, achieving a 90 percent success rate. In a test against Claude Code, a malicious CLAUDE.md file redirected API traffic to an attacker-controlled server. This technique exposed the agent's OAuth token, allowing the server to impersonate the model and return tool calls that executed code in roughly 50 percent of tests, demonstrating that markdown instructions can hijack accounts.

AI coding agents hijacked using AGENTS.md: why it matters now

This development matters because developers grant autonomous agents expansive system access while treating intake folders as casual workspaces. Forever Security emphasized that ~/Downloads is special because it is the one folder the web can write to on its own, making it an exceptionally hazardous environment for autonomous software. Because agents interpret local markdown files as operational guidelines, planting a document in an intake folder bridges passive web browsing with active terminal execution. Traditional security tools struggle because plain-text instruction files contain no binary exploits and rely on intended agent capabilities.

The threat escalates significantly once rogue instructions extract valid credentials from developer machines. Data from The Blue Report 2026, which analyzed defenses across 338 million simulations in customer production environments, revealed that prevention drops sharply once attackers obtain valid credentials, blocking only 37 percent of adversary actions. Because the technique demonstrated against Claude Code exposes authentic OAuth tokens, attackers gain verified credentials that bypass anomaly filters. Post-exploitation operations executed through stolen agent tokens therefore become difficult for corporate defense teams to differentiate from legitimate automated developer workflows.

AI coding agents hijacked using AGENTS.md: who is affected

This vulnerability affects developers and engineers who run AI command-line assistants outside structured project repositories. Forever Security researcher Gal Weizman explained that people frequently launch AI agents inside ~/Downloads to organize files or act on newly downloaded data. Telemetry gathered by the firm revealed that hundreds of customer accounts run AI assistants, including Claude Code, OpenAI Codex, and Cursor CLI, directly from ~/Downloads. Claude Code alone launched more than 1,300 sessions from that folder, confirming that operating coding agents in intake locations is an established habit across commercial teams.

Users running browsers configured with default download settings face the greatest exposure. Chrome, Edge, and Firefox automatically save files straight to ~/Downloads without prompting for a destination, whereas browsers like Brave prompt users to approve downloads before saving files locally. While Chrome, Edge, and Firefox display download notifications, busy developers frequently overlook alerts or ignore existing files sitting in intake directories. Anyone running autonomous agents in unmanaged directories without permission sandboxes risks exposing their local machine to rogue instructions planted by external web pages.

AI coding agents hijacked using AGENTS.md: what to watch

Developers should immediately revise where they launch autonomous coding assistants across their systems. Both OpenAI and Anthropic recommend starting an AI coding agent in the root of the specific project it should work on, rather than in a home directory or broad parent folder. Scoping the working directory provides appropriate context and establishes a narrow filesystem boundary, preventing agents from processing untrusted files in unrelated locations. Developers should also review unfamiliar AGENTS.md and CLAUDE.md files before permitting assistants to follow them, treating markdown instructions like executable scripts.

Organizations must enforce technical controls to safeguard agent workflows, keeping interactive approval prompts and sandbox protections enabled at all times. Potentially untrusted code should be tested inside isolated virtual environments before running on primary workstations. Security teams should monitor directory usage to prevent agents from executing within intake locations like ~/Downloads, and configure browsers to require confirmation before saving downloads. Because agent providers cannot patch intended instruction-following behavior, user vigilance, defensive browser configurations, and strict working directory hygiene remain primary defenses against malicious instruction hijacking.