Malicious AGENTS.md files in Downloads can hijack AI coding agents

[Zoe]

Security researchers have found a simple way to hijack AI coding agents, and it relies on a folder almost everyone has. BleepingComputer reports that Forever Security discovered a malicious AGENTS.md file in a customer's Downloads folder

A coding agent had been started with Downloads as its working folder. It loaded the file automatically, as these tools are designed to do with instruction files, and then tried to install a rogue npm package called function-color

The researchers reproduced the attack on popular tools. With OpenAI's Codex, a harmless test payload that opened the calculator worked in 90 percent of tests. With Claude Code, a malicious CLAUDE.md redirected the agent's API traffic to the researchers' server, exposing the OAuth token, which could allow account takeover and code execution, in about 50 percent of tests

Researcher Gal Weizman said hundreds of Forever's customers run agents such as Claude Code, Codex and Cursor CLI from Downloads, with Claude Code alone launching more than 1,300 sessions there. The researchers say there is nothing for OpenAI or Anthropic to patch, because the agents are working as designed. Downloads is the one folder the web can write to on its own, and in BleepingComputer's test, Chrome, Edge and Firefox saved the file there without asking, while Brave asked first

The advice is simple. Never run agents from Downloads, start them in the project folder, check unfamiliar instruction files, and keep approval prompts and sandboxing switched on. It is a good reminder that agent instruction files are effectively code and should be treated with the same suspicion

Where do you usually launch your coding agents from? And should agents ask before loading instruction files they have not seen before?

AI coding agents hijacked using AGENTS.md file in Downloads folderwww.bleepingcomputer.com

[Nightcrawler16]

OAuth token exposure is the scary part. Once someone has that, they can act as you. Rotate tokens if you think you ever ran an agent somewhere risky