A single text file sitting in a Downloads folder was enough to hijack AI coding agents, according to BleepingComputer, which reported the findings on October 25. Researchers at Forever Security traced a coding agent’s attempt to install a malicious npm package, called function-color, to an AGENTS.md file in the customer’s Downloads folder, the same folder the agent had been launched from. The researchers reproduced the attack against OpenAI Codex with a 90% success rate, and used a related technique against Claude Code to expose its login token. No vendor patch can fix it, the researchers said, because the agent was doing exactly what it was built to do.
How A Plain Text File Took Over An Agent
AGENTS.md files are plain-text instruction files that tell a coding agent how to work on a project. They list the tools to use, how to run tests, and the coding conventions to follow. Agents automatically load the applicable files from their working directory and follow the instructions inside them.
That loading is the whole attack. The files are not executables, but their instructions can push an agent to run commands, install packages, or change settings using the tools and permissions the agent already has. On the customer’s computer, the agent’s working directory was the Downloads folder itself, so the planted file was picked up as legitimate project guidance.
Forever Security, which monitors risks introduced by AI agents, found the case on a customer’s machine. The agent tried to install the rogue npm package function-color, and the investigation traced that attempt to the AGENTS.md file in the Downloads folder. The researchers could not determine how the malicious file reached that folder.
What The Researchers Tested
The team rebuilt the attack chain and tested it against OpenAI Codex using a harmless payload that simply opened the calculator app. It worked in 90% of attempts. In a separate test, the researchers used a malicious CLAUDE.md file to redirect Claude Code’s API traffic to a server they controlled.
That redirection exposed the agent’s OAuth token. With the token, the researchers’ server could impersonate the model and return tool calls that executed code, succeeding in roughly 50% of tests. Visiting a malicious page could be enough to drop the payload, the researchers told BleepingComputer, with no user interaction required.
BleepingComputer verified the proof-of-concept page itself. It downloaded an AGENTS.md file containing harmless content, namely the strings “sensitive data here” and “line 2.”
Why The Downloads Folder Is The Weak Spot
Forever Security’s report, published this week, puts the problem bluntly. According to the researchers, the Downloads folder is special because it is the one folder the web can write to on its own, and a web page can download a file named AGENTS.md into it silently.
By default, Chrome, Edge, and Firefox save downloaded files to the Downloads directory without asking the user to pick a location each time. Brave, in BleepingComputer’s tests, prompted the user to approve the download instead. Chrome, Edge, and Firefox do show download notifications by default, but a notification is easy to miss.
The attack still needs one human step: the target must launch the AI agent in that same directory so it loads the instruction file. Researcher Gal Weizman told BleepingComputer that this is common practice, because people often use agents to organize that folder or to act on a newly downloaded file. Company statistics show hundreds of customers run AI agents, including Claude Code, OpenAI Codex, and Cursor CLI, from their Downloads folders. Claude Code alone launched more than 1,300 sessions from that location, Weizman said.
Why It Matters
The finding matters because it breaks the usual security story. There is no software bug to patch and no vendor update that closes the hole. As the researchers put it, there is nothing here for OpenAI or Anthropic to patch, because an agent that follows the AGENTS.md file in its folder is doing exactly what it was built to do. The risk comes from intended browser behavior and intended agent behavior combining in one folder.
That combination puts the defence on the user. The same pattern has shown up elsewhere in coding-agent security: agentic attackers looting servers through PHP2Shell demonstrated how quickly an agent-driven intrusion can move, and an earlier console breach exposed provider API keys that users had stored for their agents.
OpenAI and Anthropic both recommend running their coding agents from the project directory they are meant to work on, not from a broad folder like Downloads. Review unfamiliar AGENTS.md, CLAUDE.md, and similar instruction files before letting an agent follow them, keep approval prompts and sandbox protections switched on, and test untrusted code in isolation before running it on a main system.
Background
AI coding agents such as Codex, Claude Code, and Cursor CLI have become everyday developer tools, reading project instructions automatically so they can work across a codebase without constant guidance. That convenience is the exposure: anything that can place a file in the agent’s working directory can, in effect, hand the agent its orders, and the Downloads folder is the one directory where the web can place files with the least friction. A compromised package release hid a credential stealer in a different supply-chain case this month, showing how developer tooling becomes the delivery route.
Source: BleepingComputer — AI coding agents hijacked using AGENTS.md file in Downloads folder
0 Comments