Malicious AGENTS.md in ~/Downloads can hijack your AI coding agent
If you run Claude Code, OpenAI Codex, or Cursor CLI, there is a real attack chain you should know about. Researchers at Forever Security found it on a customer’s machine, reproduced it in a lab, and confirmed it works against two major AI coding agents.
How the attack works
AI coding agents automatically load instruction files from their working directory. Files like AGENTS.md and CLAUDE.md are plain-text markdown files that tell an agent which tools to use, how to run tests, and which conventions to follow. They are not executables, but an agent will act on whatever instructions they contain.
The attack plants a malicious AGENTS.md file in the target’s ~/Downloads folder. From there, it waits for the user to launch an AI coding agent in that directory. When they do, the agent reads the file and follows the instructions.
The delivery mechanism is straightforward. Chrome, Edge, and Firefox all save downloaded files to ~/Downloads without prompting the user to choose a location. According to Forever Security researcher Gal Weizman, simply visiting a malicious web page can drop the file silently. The researchers built a proof-of-concept page that demonstrated this. BleepingComputer verified it: the page downloaded an AGENTS.md file without any user interaction beyond the visit.
Brave prompted for approval before saving, which would alert the user. Chrome, Edge, and Firefox show a download notification after the fact, but the file lands regardless.
What the researchers tested
Forever Security ran two separate attack scenarios:
- OpenAI Codex: A harmless payload that opened the calculator app. The attack succeeded in 90% of tests.
- Claude Code: A malicious
CLAUDE.mdfile that redirected the agent’s API traffic to a server the researchers controlled. This exposed the agent’s OAuth token, letting the server impersonate the model and return arbitrary tool calls. This succeeded in roughly 50% of tests.
The researchers also found real-world evidence of exposure. Their internal data showed hundreds of customers running AI coding agents, including Claude Code, OpenAI Codex, and Cursor CLI, from ~/Downloads. Claude Code alone had logged more than 1,300 sessions launched from that location.
Nobody is patching this
Forever Security is explicit on this point: there is nothing for OpenAI or Anthropic to fix. An agent that follows an AGENTS.md file in its working directory is doing exactly what it was designed to do. The risk comes from combining two intended behaviors, browser auto-download and agent instruction loading, in a location the user treats as safe.
What to do
- Never set
~/Downloadsas an AI coding agent’s working directory. OpenAI and Anthropic both recommend starting agents from the root of the specific project they should work on. - Keep the working directory scoped as narrowly as practical. Expand access only when the task genuinely requires it.
- Review any unfamiliar
AGENTS.md,CLAUDE.md, or similar instruction files before letting an agent act on them. - Keep approval prompts and sandbox protections enabled.
- Test potentially untrusted code in an isolated environment before running it on your main system.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
