A Downloaded AGENTS.md File Can Hijack Your Coding Agent
Researchers at Forever Security found a malicious AGENTS.md file in a customer's Downloads folder directing their coding agent to install a rogue npm package. Codex and Claude Code automatically follow AGENTS.md and CLAUDE.md files from the working directory, and a web page can silently drop one into Downloads. Tests launched apps in Codex 90 percent of the time and exposed Claude Code's OAuth token about half the time.
On this page
A real find, not a thought experiment
Researchers at Forever Security found a malicious AGENTS.md file on a customer's computer, sitting in the Downloads folder, which was also the working directory where the customer ran their AI coding agent. The file's instructions drove the agent to install a rogue npm package called function-color, according to Help Net Security's report on the disclosure. How the file got there is unknown; what matters is that the agent read it and obeyed.
This is not hypothetical. Forever's Gal Weizman reported that the company's telemetry shows more than 1,300 Claude Code sessions launched from Downloads by their customers, with hundreds of users running agents from that folder.
Why instruction files are the perfect delivery vehicle
Codex, Claude Code and similar agents automatically load instruction files such as AGENTS.md and CLAUDE.md from the working directory and follow them. Those files are plain text and contain nothing executable, which is exactly why they slip past intuition: an agent that follows the AGENTS.md in its folder, as BleepingComputer puts it, is doing exactly what it was built to do, so there is nothing for OpenAI or Anthropic to patch.
The delivery is the other half of the problem. Downloads is the one folder a web page can write to on its own, and browsers handle a file named AGENTS.md like any other download: Brave asks for approval, while Chrome, Edge and Firefox show only a notification after the file has landed. A hostile page needs no exploit, only a plausible download.
What the tests showed
Forever Security built proofs of concept for both major agents. A malicious AGENTS.md launched the calculator app in OpenAI Codex in 90 percent of attempts. A CLAUDE.md variant redirected Claude Code's API traffic to the researchers' server, which exposed the OAuth token, let them impersonate the model, and opened the door to returning tool calls that execute code; that worked about half the time. Windows Forum's writeup covers the same exposure on both agents.
The find lands in a week of related results: a Claude Code MCP hijack demo that steals a connected SaaS app's OAuth token through a man-in-the-middle technique, a malicious npm package named codexui-android built to steal OpenAI Codex tokens, and a single poisoned GitHub issue that hijacked Claude Code Action into repo write access. The common thread is that agent tooling trusts text, and text is trivial to plant.
How to protect your own agents
The recommendations are mundane, which is what makes them easy to skip. Launch agents from the root of the specific project you are working on, never from Downloads or other directories the web can write to. Read any AGENTS.md or CLAUDE.md you did not write yourself before letting an agent load it, the same way you would read a shell script before running it. Keep approval prompts and sandboxes on, and test untrusted code in isolation.
For readers of this blog there is an extra wrinkle: the convention itself is the asset. Repositories that ship an AGENTS.md so agents behave well, as this project does, depend on the file being trustworthy. A hijack that works in Downloads works anywhere an untrusted file can share a name with an instruction file, so treat the presence of an AGENTS.md as a claim to verify, not a feature to assume.