AI Coding Agents Hijacked via Malicious Instructions in Downloads Folder

Researchers at Forever Security identified a new attack vector targeting AI coding agents like OpenAI Codex and Claude Code. The attack uses malicious AGENTS.md files—markdown documents that normally provide project-specific instructions to AI agents on coding conventions and tool usage. When crafted maliciously, these files trick agents into executing arbitrary commands, installing rogue packages, or stealing authentication tokens for account takeover.

The attack chain exploits a combination of browser and user behavior. Malicious AGENTS.md files can be silently downloaded to a user’s Downloads folder when they visit a compromised website, a default action in Chrome, Edge, and Firefox. Many developers routinely launch AI agents from Downloads to process newly downloaded files. Forever Security found that hundreds of customers run agents from this location—Claude Code alone launched over 1,300 sessions there. When an agent starts in the Downloads directory, it automatically loads and obeys any instruction files it discovers.

Tests demonstrated 90% success against Codex for command execution and roughly 50% success against Claude Code for credential theft. The issue stems from intended agent behavior—they’re designed to follow instructions in their working directory. Mitigation requires user discipline: running agents from project-specific directories rather than broad folders, enabling approval prompts, and reviewing unfamiliar instruction files before allowing execution. OpenAI and Anthropic recommend confining agents to the root directory of the specific project they’re intended to work on.