One AGENTS.md in Downloads is all it takes to hijack an AI coding agent

One text file, one npm command

Researchers at Forever Security, a company that tracks the risks AI agents introduce, were looking into odd behaviour at a client: its coding agent kept trying to install a malicious npm package called function-color. The culprit wasn’t a binary or a rigged extension. It was a Markdown file, AGENTS.md, sitting in the client’s ~/Downloads folder. That folder was also the agent’s working directory, and that’s the whole problem. Bleeping Computer covered the story on 25 October 2026, following a report the company published this week.

A quick refresher: AGENTS.md (or CLAUDE.md for Claude Code) is a plain text file that gives an agent a project’s ground rules: which tools to use, how to run the tests, which coding conventions to follow. Agents automatically load any they find in their working directory and use them to guide what they do. The file runs nothing by itself. It just asks. The agent, which has a terminal and its user’s permissions, does the rest. It’s the first README in history that someone actually read to the end, and it used the moment to start giving orders.

According to the researchers, there’s nothing for OpenAI or Anthropic to fix: an agent that follows the AGENTS.md in its folder is doing exactly what it was built to do.

The one folder the web can write to on its own

Forever Security couldn’t work out how the file got there. Its researchers did show how it could get there. By default, Chrome, Edge and Firefox save downloads straight to ~/Downloads without asking where, and a web page can drop a file named AGENTS.md there with no interaction at all. Bleeping Computer tried their demo page, and it did download an AGENTS.md with harmless contents. One caveat: all three browsers show a download notification, and when the outlet tested Brave, it asked the user to approve the download.

There’s one more condition: you have to launch your agent in that same folder. Forever Security says that’s common, because people happily ask an agent to tidy up Downloads or deal with a file they just grabbed. The company’s internal stats count hundreds of clients running Claude Code, OpenAI Codex or Cursor CLI from that folder, including more than 1,300 sessions for Claude Code alone. Your hard drive’s junk drawer has quietly become mission control.

90% for Codex, about 50% for Claude Code

The researchers rebuilt the attack chain against Codex with a harmless payload that opened the calculator. It worked 90% of the time. In another test, a malicious CLAUDE.md redirected Claude Code’s API traffic to a server they controlled. The agent’s OAuth token was exposed, and in about half the tests the server could pose as the model and send back tool calls that ran code. In other words, the agent was no longer talking to its model but to an impostor who’d learned to answer in the right format.

Keeping it in its lane

The risk comes from two behaviours that are both working as intended: the browser’s and the agent’s. The researchers conclude that it’s up to you to take precautions. Rule one: don’t make ~/Downloads a coding agent’s working directory, because that folder can hold untrusted files the agent will take as instructions. OpenAI and Anthropic already recommend launching their agents from the folder of the project they’re meant to work on. A directory scoped to the project means the agent only reads what you chose to put there.

Rule two follows from the first: a download notification you weren’t expecting deserves a second look, especially if the file is called AGENTS.md or CLAUDE.md.

It took years of phishing drills to teach humans not to open whatever lands in Downloads. Your agent never sat through the mandatory security training, so don’t give it a desk in there.