Your Downloads Folder Can Now Give Orders to Your AI Coding Agent

If you run an AI coding agent from your Downloads folder, a file you never wrote can tell it what to do. That is the short version of a BleepingComputer report on research from Forever Security. The fix is cheap, so this one is worth a few minutes.

What the researchers found

Forever Security monitors risks from AI agents and autonomous software. On a customer’s machine, they saw a coding agent try to install an npm package called function-color, which was malicious. They traced the attempt to an AGENTS.md file sitting in the customer’s ~/Downloads folder, which was also the agent’s working directory.

Files like AGENTS.md are plain-text instructions for coding agents: which tools to use, how to run tests, which conventions to follow. Agents load applicable files from their working directory automatically and follow them. The files aren’t executables, but if the instructions are malicious, the agent can run commands, install packages, or change settings using whatever permissions it has.

The researchers put it bluntly: “There is nothing here for OpenAI or Anthropic to patch. An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do.”

How the file gets there

The researchers couldn’t determine how the file landed in that customer’s Downloads folder. But they told BleepingComputer that simply visiting a malicious page could drop a payload with no user interaction. In their words, “~/Downloads is special. It is the one folder the web can write to on its own,” and “a web page can download a file named AGENTS.md into your Downloads folder, silently.”

They built a proof-of-concept page to show this. When BleepingComputer checked it, the page downloaded an AGENTS.md with harmless content (the strings “sensitive data here” and “line 2”).

Browser behavior matters here:

• Chrome, Edge, and Firefox save downloads to ~/Downloads by default without asking where to put each file.
• Those same browsers show a download notification by default, so a user could notice.
• In BleepingComputer’s tests, Brave prompted the user to approve the download.

The second step needs the victim to start an AI agent in that same directory. Forever researcher Gal Weizman said that is common, since people use agents to organize that folder or act on a newly downloaded file. He said internal statistics show hundreds of customers run agents such as Claude Code, OpenAI Codex, and Cursor CLI from ~/Downloads. Claude Code alone launched more than 1,300 sessions from there.

How well it worked

The researchers reconstructed the attack chain and tested it against Codex with a harmless payload that opened the calculator app. They reported a 90% success rate.

They also showed a related technique against Claude Code. A malicious CLAUDE.md redirected the agent’s API traffic to a server the researchers controlled. That exposed the agent’s OAuth token, and the server could then impersonate the model and return tool calls that executed code. That worked in roughly 50% of tests.

The researchers describe the risk as a mix of intended browser behavior and intended agent behavior, which leaves defense largely in the user’s hands.

My take

This isn’t a bug in the usual sense, and that’s what makes it interesting. Nothing is broken. A browser saves a file where it’s supposed to. An agent reads instructions where it’s supposed to. Put those two correct behaviors next to each other and you get a path from a web page to code execution on a developer’s machine.

The underlying problem is trust. An agent treats the instruction file in its working directory as coming from you. The working directory is only a location, though, and a folder that anyone on the web can write to is not a trustworthy source of instructions. The same logic applies to any folder holding things you pulled from somewhere else: cloned repos, unzipped archives, shared drives.

The Claude Code case worries me more than the npm one. Losing an OAuth token means more than one bad command. Someone can sit in the middle of your agent’s traffic and feed it tool calls. That’s a different class of compromise, and it came from a text file.

One caveat: the success rates come from the researchers’ own tests, and the Codex test used a calculator payload, not a real attack. I’d treat the numbers as proof of feasibility, not as a forecast of how often this happens in the wild. Also, the researchers couldn’t say how the original file reached the customer’s folder, so the web-drop path is demonstrated in a PoC, not confirmed as the cause in that incident.

What to do about it

These steps follow the guidance in the report, plus a few habits I’d add.

1. Don’t launch an agent from ~/Downloads. Start it in the root of the project it should work on. OpenAI and Anthropic both recommend this, and advise against starting in your home directory or a broad parent folder.
2. Keep the working area narrow. Expand access only when you need to. The working directory sets the agent’s default context and, depending on the tool, helps define its filesystem boundary.
3. Read unfamiliar instruction files first. Check any AGENTS.md, CLAUDE.md, or similar file before letting an agent follow it. If you didn’t write it or review it, don’t assume it’s safe.
4. Leave approval prompts and sandboxing on. Those are the controls that give you a chance to catch a strange package install or settings change.
5. Test untrusted code in isolation. Use a separate environment before running it on your main system.
6. Check your own habits. Search your shell history or session logs for agent runs started from Downloads. If you find them, that’s your exposure.
7. Consider your browser’s download prompt. Asking where to save each file, as Brave did in BleepingComputer’s test, gives you a chance to notice a file you didn’t expect. If you leave automatic downloads on, at least pay attention to the notification.

If you manage a team, add “where do people launch their agents” to your checklist. It’s a simple rule to set, and it closes off a path that needs no exploit at all.

Sources

• AI coding agents hijacked using AGENTS.md file in Downloads folder — BleepingComputer, 2026-10-25