AI coding agents hijacked via AGENTS.md file in Downloads folder

Researchers show attackers can manipulate OpenAI Codex and Claude Code by exploiting how browsers save files and agents read instructions

By LineZotpaper AI staff

Published25 October 2026

Read Time2 min

Follow this storyHear when it moves

Illustration: AI coding agents hijacked via AGENTS.md file in Downloads folder

Security researchers have demonstrated that AI coding agents can be hijacked by a malicious AGENTS.md file placed in a user's Downloads folder, tricking the tool into installing rogue packages or leaking OAuth tokens. The attack relies on intended browser and agent behaviour, not a software vulnerability.

Researchers at Forever Security, a company that monitors risks from AI agents, discovered the tactic on a customer's computer when a coding agent attempted to install a malicious npm package. The investigation traced the attempt to an AGENTS.md file in the user's ~/Downloads folder, which also served as the agent's working directory.

AI coding agents such as OpenAI Codex and Claude Code automatically load instruction files from their working directory and follow the commands they contain. While AGENTS.md is not an executable, malicious instructions can lead the agent to run commands, install packages, or change settings.

"There is nothing here for OpenAI or Anthropic to patch. An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do," the researchers said.

The researchers created a proof-of-concept showing that simply visiting a malicious web page can silently download an AGENTS.md file into ~/Downloads, as many browsers save files there without prompting. The attack then requires the user to launch the AI agent in that same directory, which Forever's Gal Weizman said is common practice.

In tests, a harmless payload opened the calculator app on OpenAI Codex with a 90% success rate. A separate test against Claude Code used a malicious CLAUDE.md file to redirect API traffic to a server controlled by the researchers, exposing the agent's OAuth token and allowing code execution in roughly 50% of tests.

OpenAI and Anthropic recommend running AI coding agents from the root of the specific project they should work on, keeping the working directory narrow and reviewing unfamiliar instruction files before allowing an agent to follow them. Users should also keep approval prompts and sandbox protections enabled.

RSS

The Daily Edition

The front page in your inbox each weekday morning: the lead, the picks, and why each one earned its place.

Analysis

Why This Matters

The attack exploits common user behaviour (running agents from ~/Downloads) and default browser settings, making it easy to execute with no software patch needed.
AI coding agents are increasingly adopted by developers, who may not realise the security implications of their working directory.
Successful exploitation could lead to supply-chain compromise via rogue npm packages or loss of API credentials.

Background

AI coding agents rely on instruction files such as AGENTS.md and CLAUDE.md, which contain project-specific guidance on tools, tests and coding conventions. These files are automatically loaded from the agent's working directory. Meanwhile, major browsers such as Chrome, Edge and Firefox save downloaded files to the user's ~/Downloads folder by default, often without requiring confirmation for each download. The attack chains these two intended behaviours: a malicious instruction file is placed in Downloads by a web page, and if the user launches an agent in that folder, the agent follows the instructions.

What to Watch

Whether browser vendors change default download handling for plain-text instruction files like AGENTS.md.
Whether AI agent tools introduce warnings or block launching from common download directories.
Adoption of sandboxing or approval prompts that require user confirmation before an agent executes commands based on instruction files.

Sources

AI coding agents hijacked using AGENTS.md file in Downloads folder · BleepingComputer

Checked

11 claims in this story checked against 1 source: 9 supported.

Show each claim

SupportedAI coding agents were hijacked using an AGENTS.md file in a Downloads folder.BleepingComputer: “AI coding agents hijacked using AGENTS.md file in Downloads folder.”
SupportedResearchers demonstrated that attackers can manipulate OpenAI Codex and Claude Code by exploiting browser downloads and agents’ instruction-file behaviour.BleepingComputer: “The researchers' test confirmed that an attacker could use such a file to manipulate OpenAI Codex and Claude Code into executing code or stealing credentials.”
Partly supportedA malicious AGENTS.md file can trick a coding agent into installing a rogue package or leaking OAuth tokens.BleepingComputer: “Researchers found a malicious AGENTS markdown instruction file in a customer’s Downloads folder that tricked an AI coding agent into installing a rogue npm package. They reproduced the attack against OpenAI Codex and demonstrated a related technique against Claude Code to leak OAuth tokens”
SupportedThe attack relies on intended browser and agent behaviour, not a software vulnerability.BleepingComputer: “The researchers say that the risk is a combination of intended browser and agent behavior, which puts the precaution and defense responsibility directly on the user.”
SupportedForever Security researchers discovered the tactic on a customer’s computer after a coding agent attempted to install a malicious npm package.BleepingComputer: “Researchers at Forever Security, a company that monitors for risks introduced by AI agents and autonomous software, discovered the tactic on a customer’s computer, where a coding agent attempted to install the malicious npm package ‘ function-color .’”
SupportedThe customer’s ~/Downloads folder also served as the agent’s working directory.BleepingComputer: “The investigation traced the AI agent’s attempt to install a malicious npm package to an AGENTS.md file in the customer’s ~/Downloads folder, which also served as the agent’s working directory.”
SupportedThe researchers said, “There is nothing here for OpenAI or Anthropic to patch. An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do.”BleepingComputer: “"There is nothing here for OpenAI or Anthropic to patch. An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do," the researchers say .”
SupportedA proof of concept showed that visiting a malicious web page can silently download an AGENTS.md file into ~/Downloads, where many browsers save downloads without prompting the user to choose a location.BleepingComputer: “The researchers created a proof-of-concept (PoC) to demonstrate how the attack could land a malicious file into the ~/Downloads location without the user noticing.”
SupportedThe attack requires the user to launch the agent in the same directory, which Forever researcher Gal Weizman said is common practice.BleepingComputer: “After dropping the file into Downloads, the attack would require the target to launch their AI agent in that same directory so it could load the instruction file and digest its malicious instructions. Forever researcher Gal Weizman told BleepingComputer that this is common practice”
SupportedA harmless Codex payload opened the calculator app with a 90% success rate; a separate Claude Code test used CLAUDE.md to redirect API traffic, expose an OAuth token and execute code in roughly 50% of tests.BleepingComputer: “The researchers tested their reconstructed attack chain against Codex using a harmless payload that simply opened the calculator app, recording a 90% success rate. In a separate test, they used a malicious CLAUDE.md file to redirect Claude Code’s API traffic to a server they controlled. This exposed the agent’s OAuth token, allowing the server to impersonate the model and return tool calls that executed code in roughly 50% of tests.”
Partly supportedOpenAI and Anthropic recommend reviewing unfamiliar instruction files before allowing an agent to follow them.BleepingComputer: “OpenAI and Anthropic recommend running their AI coding agents from the project directory they are intended to work on. Keeping the working directory scoped to the relevant project helps provide the agent with appropriate context and limits its working scope”