Forever Securitya company that monitors risks introduced by AI agents and autonomous software, found a coding agent attempting to install the malicious npm package on a customer’s computer function-color. The investigation traced the attempt to a file AGENTS.md in the folder ~/Downloadswhich was also the agent’s working directory. The researchers then replayed the attack against OpenAI Codex and demonstrated a similar technique against Claude Code to leak OAuth tokens.
Files like AGENTS.md are text documents with project-specific instructions for coding agents: the tools to use, how to run the tests, the coding conventions to follow. Agents automatically upload the applicable files from their working directory and adjust what they find written there. They are not executable, but malicious instructions can lead the agent to launch commands, install packages or modify settings, with the tools and permissions at its disposal. The researchers see no flaws to fix: “There is nothing here that OpenAI or Anthropic needs to fix. An agent that follows the AGENTS.md of its folder does exactly what it was built to do.”
On the reconstructed attack chain, the researchers tried Codex with a harmless payload that simply opened the calculator app, and they record a 90% success rate. On Claude Code the technique is different: a CLAUDE.md maliciously hijacked the agent’s API traffic to a server controlled by the researchers. So the server received the OAuth token of the agent and was able to pass itself off as the model, returning calls to tools that executed code in about the 50% of tests.
From the browser to the agent working directory
Researchers were unable to determine how AGENTS.md ended up in the client’s folder. Gal Weizman, researcher at Forever, explains, however, that a visit to a malicious page would have been enough to deposit the file without any user interaction. In the report released this week, the company writes that ~/Downloads “is special” because “it’s the only folder the web can write to itself,” and that “a web page can silently download a file called AGENTS.md to the Downloads folder.”
Forever has prepared a demo page to show how the file can arrive in ~/Downloads without the user realizing it. A check by BleepingComputer confirmed the download of an AGENTS.md with harmless content, only the strings “sensitive data here” and “line 2”. Chrome, Edge, and Firefox by default save downloaded files to ~/Downloads without asking where, but display a notification alerting the user of the save. Brave, in the BleepingComputer tests, instead asked to approve the download, a step that should be enough to get the file noticed.
After the download, the victim still needs to launch the agent in that same folder. For Weizman it’s a widespread habit, because agents are used to tidy up ~/Downloads or to work on a newly downloaded file. Forever’s internal statistics indicate that hundreds of customers run agents like Claude Code, OpenAI Codex, and Cursor CLI from ~/Downloads, and that Claude Code alone has initiated more than 1,300 sessions from that position.
How to reduce the risk
The risk arises from the combination of two expected behaviors, that of the browser and that of the agent, and for researchers the responsibility for defense therefore falls on the user. The first precaution is do not use ~/Downloads as your working directory of a coding agent, because the folder may contain untrusted files that the agent interprets as instructions. OpenAI and Anthropic recommend starting their agents in the root of the project they need to work on, not in the home or larger directory. A bounded working directory provides the agent with appropriate context and, depending on the tool, helps to set the boundary of its access to the filesystem.
Instruction files that the user does not recognize, such as AGENTS.md and CLAUDE.md, should be checked before letting the agent follow them. The approval requests and sandbox protections they must remain active. Code of dubious origin must be tested in a isolated environment before running it on your main system.
