Malicious AGENTS.md files can hijack your coding agent via Downloads
A new attack vector targets developers who use AI coding agents. Security firm Forever Security found that a website can silently drop a plain text file into your Downloads folder and use it to take over your coding agent the next time you work in that directory.
No click required. No permission prompt. Just a file your agent is built to obey.
How the Attack Works
Coding agents like OpenAI Codex and Anthropic’s Claude Code read instruction files from the folders they work in. Codex reads AGENTS.md. Claude Code reads CLAUDE.md. Developers use these files to give agents standing instructions about a project.
Browsers can write files to Downloads without user approval. Operating system protections that block untrusted executables don’t apply to plain text files. That combination is the attack surface.
Forever’s researchers Gal Weizman and Omer Samet put it directly:
“An AGENTS.md is a file a coding agent is built to trust and obey, and ~/Downloads is the one folder a website can drop a file into with no click and no permission. Together, that lets the web plant orders your own agent carries out. Markdown is the new executable.”
Codex vs. Claude Code: How Each Responded
The researchers tested both agents against planted instruction files. The results were different but both were bad.
Codex: The planted AGENTS.md was a 13 KB document written to look like ordinary engineering guidelines. Codex ran the attacker’s commands in more than 90% of attempts. The length and mundane tone of the file helped it get through. A short, blunt request to install a package gets refused. A document that reads like internal dev standards does not.
The malicious package named in the file was function-color, part of a campaign on npm that went undetected for roughly two years before being publicly documented and removed. The settings Codex changed applied machine-wide, so every subsequent Codex session ran the attacker’s command regardless of which project the user opened.
Claude Code: Claude was harder to fool, the researchers noted, and required a completely different approach. Their planted CLAUDE.md instructed the agent to save a settings change that redirected Claude Code’s outbound API requests to an attacker-controlled server. Claude Code followed through on this about 50% of the time.
Every request Claude Code sends carries the user’s login token. When the researchers replayed a captured token against Anthropic’s service, they were treated as the victim and took over the account without running any code. On subsequent sessions, the attacker’s server could impersonate the AI model and instruct the agent to run commands with its sandbox disabled.
️ Why There Is No Patch Coming
Forever’s researchers argue this isn’t something OpenAI or Anthropic can fix. An agent that follows the instruction file in its working directory is functioning correctly. A browser that renders a phishing page is also functioning correctly. The vulnerability is in the combination, not either component individually.
About half of Forever’s customers run a coding agent inside the Downloads folder. About a quarter of agent sessions open a browser. That means the agent itself can visit the page that drops the file, making it both the target and the delivery mechanism.
What to Do Now
The researchers noted no purchase is required to act on this today. Their recommendations:
- Don’t start any coding agent while your working directory is Downloads.
- Read any
AGENTS.mdorCLAUDE.mdfile you didn’t write before letting an agent near it, including files in freshly cloned repositories. - Check your agent settings files for server addresses or URLs you didn’t add.
- Keep approval prompts and sandboxes switched on. Any instruction telling an agent to bypass them is a red flag.
- If you find a planted file, treat your login token as compromised and rotate it immediately.
- If
function-colorwas installed on a machine, treat that machine as compromised.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
