AI Coding Agents Hijacked Using AGENTS.md File in Downloads Folder

Security researchers have uncovered a novel and deceptive cyberattack vector targeting autonomous AI coding assistants, illustrating how standard operating procedures in modern software development can be weaponized against end-users. Analysts at Forever Security, a firm specializing in the monitoring and mitigation of risks introduced by autonomous software agents, revealed that malicious actors are successfully exploiting plain-text project instruction files—specifically, files named AGENTS.md—to trick AI agents into executing arbitrary code, installing rogue software packages, and exfiltrating sensitive authentication credentials.

The discovery stems from a real-world incident observed within a customer environment, where an automated coding agent attempted to install a suspicious software package without human authorization. Subsequent investigations traced the behavior back to a maliciously crafted instruction file residing quietly within the user’s default Downloads folder. Because this directory frequently doubles as a working environment for developers testing scripts or organizing files, the vulnerability highlights a critical blind spot at the intersection of web browser automation and AI-driven software engineering.

The Mechanics of the Vulnerability

To understand how the exploit succeeds, one must examine how modern AI coding tools operate. Unlike traditional static analysis tools or rigid command-line scripts, next-generation AI assistants—such as OpenAI Codex, Claude Code, and various command-line interface (CLI) tools like Cursor CLI—are designed to be contextual and adaptive. When launched within a specific directory, these agents are programmed to automatically scan for configuration or context files. Among the most common are markdown files, such as AGENTS.md or CLAUDE.md, which developers use to outline project rules, specify preferred libraries, define build steps, and establish coding conventions.

These files do not contain compiled binaries or executable code; they are purely textual guidelines written in natural language. However, because AI models parse these instructions and translate them into actionable tool commands, they treat the contents of an AGENTS.md file as authoritative directions from the developer. If an attacker manages to place a rogue instruction file into a directory that the AI agent later adopts as its working space, the agent will dutifully parse the text and execute any embedded directives.

In the incident analyzed by Forever Security, an agent operating within a customer’s Downloads folder encountered a fraudulent instruction file that instructed it to download and install a malicious Node.js package bearing the innocuous name "function-color." Had the installation completed successfully, the package could have established persistent access, harvested environment variables, or introduced backdoors into the developer’s local machine.

The Vulnerability of the ~/Downloads Directory

A central pillar of this attack vector is the unique behavior of the ~/Downloads directory across major operating systems and web browsers. Unlike sensitive system directories or restricted project repositories, the Downloads folder is uniquely accessible from the internet. By design, it is the primary destination for files retrieved via web browsing, and in many default configurations, modern web browsers allow files to be written to this location silently or with minimal friction.

Researchers at Forever Security noted that standard web browsers, including Google Chrome, Microsoft Edge, and Mozilla Foundation’s Firefox, automatically route downloaded web assets to the user’s Downloads directory without prompting for a custom destination path by default. While these browsers typically display visual notifications or download tray indicators when a file is saved, they generally do not halt the process to demand explicit user authorization for every incoming file.

Leveraging this behavior, an attacker can deploy a drive-by download technique—such as visiting a compromised or malicious web page—to quietly drop a file named AGENTS.md directly onto a target machine’s Downloads folder without requiring any active user interaction beyond browsing the page.

Gal Weizman, a leading researcher at Forever Security, pointed out that the threat is amplified by the widespread habit of developers using their Downloads directory as a quick workspace. Internal telemetry and usage statistics shared with industry analysts reveal that hundreds of active enterprise and individual customers routinely invoke AI coding sessions directly from their Downloads folders. For instance, telemetry data gathered for Claude Code alone indicated that more than 1,300 sessions had been initialized from that single location, driven by users attempting to quickly parse, organize, or modify newly downloaded scripts, archives, or code snippets.

Experimental Replication and Proof-of-Concept Testing

To validate the real-world viability of the threat, the Forever Security research team constructed a comprehensive proof-of-concept (PoC) attack chain, testing it against prominent AI coding platforms under controlled laboratory conditions.

In tests targeting OpenAI Codex, the researchers utilized a harmless payload designed to invoke the operating system’s native calculator application. The attack achieved an impressive 90% success rate. Whenever the Codex agent was initialized inside a directory containing the manipulated AGENTS.md file, it ingested the instructions and automatically executed the command to launch the application, demonstrating that the model was entirely compliant with the deceptive text guidelines.

In a more sophisticated variation targeting Claude Code, researchers deployed a malicious CLAUDE.md file engineered to intercept and redirect the agent’s API traffic toward an external server controlled by the attacker. This redirection successfully exposed the agent’s OAuth authentication token. Once compromised, the attacker’s server was capable of impersonating the legitimate model, issuing unauthorized tool calls, and executing arbitrary code on the host machine in roughly 50% of the conducted test scenarios.

Security Implications and the Absence of Vendor Patches

A vital nuance emphasized by the discovery team is that this security flaw does not stem from a software bug or a coding oversight within the AI models themselves. Consequently, major artificial intelligence providers like OpenAI and Anthropic cannot simply issue a traditional security patch to neutralize the risk.

"There is nothing here for OpenAI or Anthropic to patch. An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do," the Forever Security researchers stated in their advisory.

Because the AI agents are functioning precisely as engineered—interpreting context files to assist the user—the vulnerability represents a systemic design challenge arising from the intersection of autonomous execution capabilities, browser permissions, and user workflow habits. The responsibility for mitigation rests heavily on the end-user and adherence to secure operational hygiene.

Industry Best Practices and Mitigation Strategies

Following the public disclosure of the research, cybersecurity experts and platform developers have reiterated fundamental security guidelines designed to protect software developers from autonomous agent hijacking.

1. Restrict Agent Working Directories: Developers must strictly avoid launching AI coding assistants, CLI tools, or autonomous agents from broad, high-risk directories such as the root user directory (~/) or the ~/Downloads folder. AI tools should always be initiated within the dedicated, isolated root directory of a specific software project.

2. Scope Permissions and Context: Keeping the working directory tightly bound to a singular project ensures that the agent operates within a predictable filesystem boundary, significantly reducing the likelihood that it will encounter or process untrusted configuration files left over from unrelated web browsing activities.

3. Inspect Configuration Files: Before granting an AI agent permission to read or execute commands based on project-level instruction files—such as AGENTS.md or CLAUDE.md—developers should manually review the contents of those files, especially if they originate from external sources or unfamiliar repositories.

4. Maintain Sandbox Protections and Prompts: Users should ensure that default safety prompts, tool-execution confirmations, and sandbox environments remain fully enabled. Blindly trusting an AI agent to execute shell commands without human-in-the-loop verification invites severe security compromises.

5. Isolated Testing Environments: When experimenting with newly downloaded code repositories or scripts from untrusted sources, developers should utilize containerized or virtualized environments to isolate potential payloads from primary production machines.

Broader Context in AI Security

The revelation regarding AGENTS.md file hijacking arrives amidst a broader industry reckoning regarding the security of autonomous software agents. As organizations increasingly adopt AI-driven development workflows to accelerate software delivery, malicious actors are pivoting their attack methodologies toward the unique trust architectures underpinning these tools.

While traditional malware relied heavily on exploiting software memory corruption vulnerabilities or tricking users into executing visibly suspicious binaries (.exe or .app files), the modern threat landscape increasingly leverages indirect prompt injection, semantic manipulation, and configuration abuse. As autonomous systems gain deeper access to local filesystems, terminal execution environments, and cloud APIs, securing the operational context in which these agents run will remain a paramount challenge for the software development community.