AGENTS.md Downloads Hijack: a Planted File Made the Agent Run Code

Forever Security found a malicious AGENTS.md in a customer's Downloads folder that pushed an AI coding agent to install a rogue npm package named function-color. The AGENTS.md Downloads hijack works because browsers may write that folder and coding agents obey instruction files in the working directory.

What did Forever Security actually find?

Forever Security found a malicious AGENTS.md in a customer’s ~/Downloads folder after an AI coding agent tried to install an npm package named function-color. On Windows that directory is %USERPROFILE%\Downloads, and the same browser default applies.

The researchers describe function-color as rogue. The account does not say whether the name was on the public npm registry, who published it, or whether anyone removed it.

The firm watches risks that AI agents introduce on customer machines. On this host, Downloads was the agent’s working directory, so the file sat in the context the agent loads by default.

Researchers could not determine how the file arrived, and they did not disclose the discovery date. Forever Security published the findings in a report this week. BleepingComputer covered that report.

The customer event is an attempted install from a planted instruction file. The lab trials used harmless payloads and do not prove a finished breach on that machine.

Why do coding agents treat AGENTS.md as orders?

AGENTS.md and CLAUDE.md are plain-text instruction files. Agents load them from the working directory without a separate import step. OpenAI Codex reads AGENTS.md. Claude Code reads CLAUDE.md.

They are plain text, but agents treat them like a runbook: tools, test commands, and coding conventions.

The files are not executables. The damage comes from the agent using its own tools to run what the text says.

Loaded instructions can make the agent run commands, install packages, or change settings. The limit is the tools and permissions that session already holds.

As analyst context, npm can run preinstall, install, and postinstall scripts. An install the agent starts can execute code before any import of the package.

OWASP lists prompt injection as LLM01:2025. Indirect delivery is one form: the text sits in a file the agent was built to trust, not in the chat box.

Repo workflows carry the same trust. A planted file belongs with malicious Git configs that make coding agents run attacker code: the agent follows a folder artifact because that is the feature.

OpenAI and Anthropic tell users to start the agent at the project root. That choice sets project context and, on some tools, the filesystem boundary. Home and Downloads invert it: files already in the tree can read as policy on the first turn.

Why is ~/Downloads a folder the web can write?

~/Downloads is a folder a web page can write. Chrome, Edge, and Firefox save files there by default and skip a per-download save prompt.

~/Downloads is special. It is the one folder the web can write to on its own.

Forever Security summed up the delivery path in one line: a web page can download a file named AGENTS.md into Downloads silently. BleepingComputer verified a proof-of-concept page.

The dropped file held only the strings “sensitive data here” and “line 2”. Brave prompted the user to approve the download in that test.

Chrome, Edge, and Firefox show download notifications by default. The notice means the save already finished. It is not a location dialog. The write-up does not say Brave shows that notice.

Chrome, Edge, and Firefox can be set to ask for a folder on every download. That prompt stops a silent new file. It leaves anything already saved where it is.

The filename is the only thing the payload exploits at this stage. Codex looks for AGENTS.md. Claude Code looks for CLAUDE.md. Either name in the next working directory is enough to load.

How did the AGENTS.md Downloads hijack behave in the lab?

Against OpenAI Codex, a harmless payload that opened the calculator reached code execution in about 90% of trials. A CLAUDE.md variant against Claude Code exposed the OAuth token and ran tool calls in roughly 50% of tests.

The Claude Code file redirected API traffic to a server the researchers controlled. That server impersonated the model and returned the tool calls.

Those rates are separate experiments with unpublished denominators. They are not comparable.

After delivery, the user is still the gate. The agent has to be started in that directory. Researchers say OpenAI and Anthropic have nothing to patch. The write-up does not mention a CVE.

There is nothing here for OpenAI or Anthropic to patch. An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do.

Ordinary developer workflow carries untrusted instructions too, including a malicious MCP server smuggled through pull requests.

An OAuth bearer token copied off the host stays valid until expiry or revocation, and only inside its scopes. Deleting CLAUDE.md does not pull that token back.

Slopsquatting — attackers registering names that models invent — is a separate route. This case is the reverse: the file names function-color, and the agent attempts the install with the user’s rights. Removing the package later does not undo preinstall or postinstall scripts that already ran.

How often do people already run agents from Downloads?

Forever Security’s telemetry shows hundreds of customers launching Claude Code, OpenAI Codex, and Cursor CLI from ~/Downloads. Claude Code alone logged more than 1,300 sessions from that folder.

Gal Weizman said people often point an agent at Downloads to tidy the folder or to handle a file just saved. That 1,300-session count includes repeat sessions per person. It does not measure confirmed compromises.

The count is one vendor’s customer base. No industry split was published, and the only case described is an unnamed customer.

What should security leads change this week?

Do not use ~/Downloads, or %USERPROFILE%\Downloads on Windows, as an AI coding agent’s working directory. Start each session at the project root.

• Review unfamiliar AGENTS.md, CLAUDE.md, and similar files before the agent follows them.
• Keep approval prompts and sandbox protections enabled.
• Set Chrome, Edge, and Firefox to ask for a save location. A download notice is a weak checkpoint.
• If a rogue install or unexpected tool call already ran, preserve the file: hash, timestamps, full text, origin metadata, and the parent directory.
• Then line up agent transcripts, shell history, npm logs, child processes, and outbound traffic.
• If API traffic was redirected, revoke the token and read provider logs. Deleting the markdown stops only the next run.
• Pull requests, templates, and archives can carry the same files. Use CODEOWNERS and required review where the platform allows it.

Hunt before the next launch. Search endpoints for AGENTS.md and CLAUDE.md outside project roots, pull browser download history for those names, and check agent logs for a working directory of Downloads or home.

A runtime firewall for AI coding agents can force approval on shell and install tools when the working directory is wrong. AI agent penetration testing should plant instruction files in web-writable folders and see whether the agent obeys them.

OpenAI and Anthropic already say to start in the project directory, not a home folder or a broad parent. Treat that as the launch rule for every coding-agent session.

Keep the working directory as narrow as the task. Expand filesystem access only when the job needs it, and turn it back down afterward.

Ban Downloads and home directories as agent working directories this sprint. Require project-root launches, and put AGENTS.md and CLAUDE.md on the review checklist.

Treat a token leak or a lifecycle script running as the developer as a credential incident. Revoke CI secrets, rotate personal access tokens, and find the package the agent tried to install.

FAQ

Is a malicious AGENTS.md a software vulnerability?

Researchers treat it as intended behavior, not a patchable product bug, and the write-up never mentions a CVE.

Can an AGENTS.md file in Downloads hijack an AI coding agent?

Yes, once the user starts the agent in that folder. Impact matches the tools and permissions already granted.

Does Chrome download AGENTS.md without asking?

Chrome, Edge, and Firefox save to ~/Downloads by default with no per-file save prompt. Brave prompted for approval in BleepingComputer's test.

What is the function-color npm package?

The name the customer's agent tried to install. Researchers call it rogue. Registry status, owner, and removal are not in the source.

How common is running Claude Code or Codex from Downloads?

Forever Security saw hundreds of customers run Claude Code, Codex, and Cursor CLI from ~/Downloads, and more than 1,300 Claude Code sessions, repeats included.

Should I delete unknown AGENTS.md and CLAUDE.md files?

Preserve and hash the file if an agent may have followed it, then delete copies in working directories and revoke tokens after any API redirect.

agent::offense tests whether coding agents obey planted instruction files, tool calls, and registry installs under the permissions your developers actually grant. Scope that work with AI agent penetration testing against the working directories your teams use.