Forever Security found a malicious AGENTS.md in Downloads

Forever Security found a malicious AGENTS.md file sitting in a customer’s ~/Downloads folder, and the AI coding agent running there had already tried to install a rogue npm package called function-color. The file was plain-text project instructions, the kind these agents read to learn which tools to use, how to run tests, and which conventions to follow. The agent loaded it because Downloads was its working directory, and it did what the file told it to.

There is no bug to patch. The researchers put it plainly: “There is nothing here for OpenAI or Anthropic to patch. An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do.” Agents load applicable instruction files from their working directory automatically. The files aren’t executables, but instructions inside them can get an agent to run commands, install packages, or change settings using whatever tools and permissions it already has.

The delivery path is what makes it work. ~/Downloads is the one folder a web page can write to on its own. By default Chrome, Edge, and Firefox save downloads there with no per-file save prompt. Forever built a proof-of-concept page that drops a file into Downloads without user interaction; when BleepingComputer tested it, the page downloaded an AGENTS.md containing harmless strings (“sensitive data here”, “line 2”). Brave prompts before saving, which would tip off the user. Chrome, Edge, and Firefox at least show a download notification, though a notification for a markdown file is easy to let slide.

Dropping the file is only half of it. The attacker still needs the target to launch an agent in Downloads so it loads the instructions. That is less of a reach than it sounds. Gal Weizman told BleepingComputer that people routinely point agents at Downloads to organize the folder or to act on something they just pulled down. Forever’s internal numbers put hundreds of customers running Claude Code, Codex, and Cursor CLI from ~/Downloads, with Claude Code alone logging more than 1,300 sessions started there.

The researchers rebuilt the chain and measured it. Against Codex, a benign payload that opened the calculator app succeeded 90% of the time. The Claude Code variant went further: a malicious CLAUDE.md redirected the agent’s API traffic to a server the researchers controlled, which exposed the OAuth token and let that server impersonate the model, returning tool calls that executed code in roughly half the tests. A leaked OAuth token also means the account itself can be hijacked.

The fix sits with the operator, because both the browser behavior and the agent behavior are working as intended. Don’t run an agent with ~/Downloads as its working directory. OpenAI and Anthropic both recommend starting an agent in the root of the specific project it should work on, not your home directory or a broad parent. The working directory sets the agent’s default context and, depending on the tool, its filesystem access boundary, so keep it as narrow as the task allows and widen only when you need to.

Beyond that, read any unfamiliar AGENTS.md, CLAUDE.md, or similar file before letting an agent act on it, keep approval prompts and sandbox protections turned on, and run anything you don’t trust in an isolated environment first.