Researchers at Forever Security found a malicious AGENTS.md file in a customer’s ~/Downloads folder after an AI coding agent attempted to install the rogue npm package function-color, according to an October 25 report by BleepingComputer.
The Downloads folder was also the agent’s working directory, allowing it to load the attacker’s instructions as part of its operating context. The researchers could not establish how the file reached the customer’s computer. The reported customer event involved an attempted package installation; subsequent researcher tests demonstrated code execution and credential theft under separate conditions.
Instructions become a route to tool access
Files such as AGENTS.md provide project-specific guidance to AI coding agents, including coding conventions, tools and test procedures. Agents automatically read applicable instruction files and use them to guide their work.
The files are plain text, but their contents can influence an agent to run commands, install software or change settings through whatever tools and permissions it has. In this case, placing malicious guidance in the directory where the agent started gave that guidance an opportunity to shape its actions.
Forever Security described the risk as a consequence of intended behavior rather than a software flaw requiring a vendor patch. That is the researchers’ assessment: an agent following a local instruction file is performing a function it was designed to support.
Browser downloads provide a possible delivery path
Although the original file’s arrival remains unexplained, the researchers built a proof of concept showing how a webpage could download an AGENTS.md file into the Downloads folder without a save-location prompt.
BleepingComputer verified that the demonstration page downloaded a harmless file containing the strings “sensitive data here” and “line 2.” This demonstrated a possible delivery mechanism, not how the customer’s malicious file actually arrived.
Chrome, Edge and Firefox commonly save downloads to ~/Downloads without asking users to choose a location for each file. They also display download notifications by default. BleepingComputer said its tests with browsers including Brave prompted for approval, providing an additional visible warning.
For this attack path to work, the target would then need to launch an AI agent in that same folder so it could read the planted instructions. Forever Security researcher Gal Weizman said internal statistics showed hundreds of customers running agents from Downloads, with Claude Code alone accounting for more than 1,300 sessions there. The report did not specify the measurement period.
Tests demonstrated execution and token exposure
Forever Security reconstructed the attack against OpenAI Codex using a harmless payload that opened the calculator application. The researchers reported a 90% success rate.
In a separate Claude Code experiment, a malicious CLAUDE.md file redirected API traffic to a server controlled by the researchers. They said this exposed the agent’s OAuth token and let their server impersonate the model, returning tool calls that executed code in roughly 50% of tests. Those percentages describe different experiments, rather than a direct comparison between the products.
The practical precaution is to keep untrusted downloads outside an agent’s working context. The report says OpenAI and Anthropic recommend starting coding agents in the root of the specific project they should work on and keeping their working scope narrow.
Users should also review unfamiliar AGENTS.md, CLAUDE.md and similar files, retain approval prompts and sandbox protections, and use an isolated environment when running potentially untrusted code.
