Security researchers show AI coding agents can be hijacked through a file quietly dropped in Downloads

A security research firm says it has found a way for a web page to quietly take control of AI coding assistants without the user clicking anything. The firm, Forever Security, published findings on Oct. 22 describing how it discovered a malicious instruction file sitting in a customer's Downloads folder, disguised as ordinary engineering notes, that caused the customer's coding agent to attempt to install a malicious software package. The company detailed the discovery in a research post titled "Markdown Is the New Executable." The report was picked up and independently corroborated by the security-news outlet BleepingComputer, which tested the underlying delivery mechanism itself.

The mechanism relies on a plain-text convention called AGENTS.md, a configuration file that tools such as OpenAI's Codex and Anthropic's Claude Code automatically read and follow when it sits in whatever folder the agent is told to work from. Forever Security's researchers, Gal Weizman and Omer Samet, found that a browser can be made to save such a file into a user's Downloads directory without any click or permission prompt, and that users and companies routinely point coding agents at that same folder.

What the researchers found

Forever Security says it discovered the attack in the wild on a real customer's machine, where a coding agent tried to install a known-malicious npm package called function-color after reading the planted file. The researchers say the campaign had gone undetected for roughly two years before being publicly documented. They were not able to determine exactly how the file reached that particular Downloads folder, but said a drive-by download from a malicious web page was sufficient in their own tests; BleepingComputer confirmed this independently by building and visiting a proof-of-concept page that silently downloaded an AGENTS.md file to its own test machine.

To test the real-world blast radius, the researchers reproduced the attacker's actual file against OpenAI's Codex inside an isolated virtual machine. Separately, they wrote their own test file, styled as a CLAUDE.md, to demonstrate a related attack against Anthropic's Claude Code: redirecting the tool's network traffic to a server they controlled, which exposed the agent's OAuth login token and could then return commands that executed code on the machine.

By the numbers

• Codex carried out the malicious instructions in more than 90 percent of the researchers' attempts.
• Claude Code followed the crafted instructions in roughly half of test runs.
• According to Forever Security's telemetry, about half of its corporate customers run a coding agent with its working directory set to Downloads.
• Claude Code alone had logged more than 1,300 sessions launched from that folder, by the researchers' count.
• About a quarter of agent sessions the firm observed opened a real web browser as part of their work, the pathway that can expose the Downloads folder to an untrusted page in the first place.

Context: an old trust problem in a new wrapper

AGENTS.md is an open convention meant to give coding assistants project-specific context — build commands, coding style, dependencies — the same way a README speaks to human developers. Its design assumes any such file found in a working directory was put there deliberately by the project's owner. Forever Security's point is that this assumption breaks down specifically in Downloads, which the researchers describe as "the one folder the web can write to on its own": browsers including Chrome, Edge and Firefox save files there by default, often without blocking or requiring approval. It is a mechanical gap, not a new flaw in the AI models themselves — the agents behave as designed when they read and act on instructions sitting in their own working folder.

"There is nothing here for OpenAI or Anthropic to patch. An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do," Forever Security wrote in its research post.

This is not the first time researchers have flagged AGENTS.md-style files as an attack surface; similar prompt-injection paths involving project configuration files and cloned repositories have been raised before by other security researchers. What distinguishes the new findings is the delivery mechanism — an ordinary web visit rather than a compromised dependency or a cloned project — and evidence that the technique was already active against a paying customer rather than confined to a lab demonstration.

Who is affected

The immediate affected population is anyone running an AI coding agent — Codex, Claude Code, or similar tools that read AGENTS.md or CLAUDE.md files — with its working directory set broadly enough to include a Downloads folder, rather than scoped to a specific project directory. Forever Security says this is common practice among its own enterprise customers. The firm also flagged that npm, the Node.js package registry, has since removed the malicious function-color package that the in-the-wild attack tried to install, and recommends that any machine with that package present be treated as compromised.

What's next

Neither OpenAI nor Anthropic has issued a software patch in response, consistent with the researchers' framing that the behavior is working as intended rather than a bug. Both companies already publish guidance pointing the same way: Anthropic's own security documentation for Claude Code describes a working-directory boundary and recommends project-specific permission settings for sensitive work, while OpenAI's security guide for Codex describes a comparable workspace-scoped sandbox that keeps file edits confined to the folder where a session started unless a user explicitly extends it. Forever Security's own recommendations for defenders include never launching a coding agent from Downloads, manually reading any unfamiliar AGENTS.md or CLAUDE.md file before letting an agent near it — including in freshly cloned repositories — checking configuration files for unexpected server entries or proxy endpoints, keeping approval prompts and sandboxing switched on, and rotating credentials immediately if compromise is suspected, since a leaked OAuth token functions as a live, reusable session. The firm says it disclosed its findings publicly rather than through a standard vendor advisory process, on the grounds that there is no code-level fix for either vendor to ship.