AI Coding Agents Hijacked via Malicious AGENTS.md in Downloads Folder

Security researchers have uncovered a novel attack vector targeting local AI coding agents, where silent web downloads of malicious instruction files can trick tools like OpenAI Codex and Claude Code into executing arbitrary commands and leaking OAuth credentials. Discovered by AI security monitoring firm Forever Security, the technique relies on dropping a malicious markdown instruction file—such as AGENTS.md or CLAUDE.md—into a user’s default download folder, which is subsequently parsed and executed when an AI agent is launched from that directory.

The initial discovery occurred on a customer endpoint where an autonomous AI agent unexpectedly attempted to install a rogue npm package named function-color. An investigation traced the action back to an AGENTS.md file sitting in the user’s ~/Downloads directory, which had been automatically ingested by the agent upon startup.

The Mechanics of Indirect Prompt Injection via Local Directories

This class of vulnerability represents an indirect prompt injection attack combined with weak local directory scoping. Modern AI coding assistants—including Claude Code, OpenAI Codex, and Cursor CLI—are designed to read project-specific context files like AGENTS.md, CLAUDE.md, or .cursorrules located in their current working directory. These plain-text files instruct the model on build conventions, testing suites, permitted tool calls, and repository structure. Because the language model treats instructions within these files as trusted operational guidelines, untrusted input placed inside them can hijack the agent’s logic.

The entry point leverages standard web browser behaviors combined with common developer habits:

1. Drive-By File Landing: Modern web browsers including Google Chrome, Microsoft Edge, and Mozilla Firefox save downloaded files directly into ~/Downloads by default without prompting the user for confirmation or save location. A malicious web page can initiate a silent file download of an AGENTS.md file without user intervention. (Browsers like Brave, which force a download approval prompt by default, break this delivery mechanism.)
2. Directory Selection Habit: Developers frequently launch CLI-based AI tools directly inside ~/Downloads to organize files, unpack archives, or experiment with newly downloaded code. Internal telemetry gathered by Forever Security revealed hundreds of customer instances running AI agents inside ~/Downloads, including over 1,300 Claude Code sessions initiated from that specific location.
3. Automatic Context Ingestion: When the agent initializes, it automatically scans its working directory for instruction files. If the working directory is ~/Downloads, the agent parses the silently dropped AGENTS.md and begins executing the embedded directives using the tools and permissions granted to the developer’s local shell.

Neither OpenAI nor Anthropic consider this behavior a software bug, as the models are operating as designed by consuming local context files. Because there is no vendor patch to issue, defense relies entirely on operating environment isolation and user behavior.

Proof-of-Concept Results: Arbitrary Code Execution and Credential Theft

Forever Security verified the feasibility of this attack vector through two controlled proofs-of-concept against major coding agent platforms:

• OpenAI Codex RCE: Researchers constructed an AGENTS.md file instructing Codex to execute a harmless payload that launched the system calculator app. When Codex was started in the target directory, the attack achieved a 90% success rate in forcing the agent to run the system command.
• Claude Code Credential Exfiltration: In a separate test using a malicious CLAUDE.md file, researchers manipulated Claude Code’s network configurations to redirect its API traffic to an attacker-controlled server. This leak exposed the agent’s active OAuth token to the remote server. With the OAuth token in hand, the rogue server impersonated the legitimate model, returning malicious tool-use responses back to the local agent to achieve arbitrary code execution in approximately 50% of trials.

Technical Impact and Blast Radius

The practical blast radius of this attack is substantial for engineering teams and enterprise environments. Because AI coding agents are routinely executed with the privileges of the underlying user account—often with direct read/write access to local source code, cloud credentials, SSH keys, and environment variables—a hijacked agent effectively grants an attacker interactive command execution on the developer’s workstation.

Once initial access is gained via a rogue package installation or malicious command execution, attackers can pivot deeper into the corporate network, exfiltrate sensitive source code, or commit malicious backdoors directly into production software repositories. This technique essentially turns an agent’s built-in tool capabilities—such as file modification, bash command execution, and package management—into a localized post-exploitation framework.

Defensive Guidance and Mitigation

Because vendor-side patches will not alter how contextual instruction files are read, organizations must enforce directory boundaries and agent sandboxing controls.

• Isolate Agent Scope: Never launch an AI coding agent with broad parent directories—such as ~/, ~/Downloads, or ~/Desktop—set as the working directory. Always scope the working directory to the specific subfolder of the project being worked on.
• Browser Configuration: Configure corporate browser policies (via Chrome Enterprise Policy or GPO) to force the browser to prompt for a download location prior to saving files, preventing silent drive-by drops into ~/Downloads.
• Audit Instruction Files: Scan repositories and local working folders for unverified AGENTS.md, CLAUDE.md, or .cursorrules files before initializing an agent session.
• Enforce Strict Tool Approvals: Retain human-in-the-loop approval prompts for all file-system write operations, network requests, and terminal command executions, avoiding flags that grant unrestricted automated execution privileges in non-isolated environments.