TL;DR
- The Discovery: Security researchers at Forever Security observed an AI coding agent attempting to install a malicious npm package after reading an
AGENTS.mdfile placed in a customer's~/Downloadsfolder. - The Mechanism: Coding assistants automatically parse instruction files in their current working directory. Malicious instructions can induce the agent to execute shell commands, install software, or modify system configurations.
- Drive-by Delivery: Browsers often save files directly into the
Downloadsdirectory without requiring explicit user approval per file, allowing untrusted sites to silently place instruction files. - Empirical Tests: Researchers demonstrated a 90% success rate executing a proof-of-concept command on OpenAI Codex and successfully leaked OAuth tokens while triggering code execution in roughly 50% of tests on Claude Code.
- Recommended Mitigation: OpenAI and Anthropic recommend restricting AI coding agents strictly to dedicated project directories rather than running them in generalized directories like
~/Downloads.
Malicious Instruction Files Found in Downloads Directories
Security researchers at Forever Security, a firm specializing in monitoring risks introduced by autonomous AI agents, discovered an attack vector on a customer's computer where an AI coding agent attempted to install a malicious npm package named function-color. Upon investigating the incident, researchers traced the installation command back to an AGENTS.md file residing in the user's ~/Downloads folder, which also served as the working directory for the active coding agent.
Modern AI coding assistants frequently rely on markdown instruction files, such as AGENTS.md or CLAUDE.md, to understand developer preferences, required development tools, build workflows, and repository guidelines. Because these assistants automatically ingest applicable instruction files from their active working directory, the presence of untrusted instructions can lead the agent to abuse its local permissions and capabilities.
According to researchers, the behavior does not represent an exploitable flaw within the underlying AI models. "There is nothing here for OpenAI or Anthropic to patch. An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do," the researchers noted in their report.
How AI Coding Agents Process Plain-Text Guidance
To assist developers with software development, AI coding tools look for configuration files in their working environment. Plain-text markdown files such as AGENTS.md act as project-level documentation, guiding how the agent should structure code, execute unit tests, or manage packages.
While markdown files themselves are not executable binaries, autonomous coding tools possess access to command-line interfaces, file manipulation tools, and administrative settings. When an agent reads natural-language directives contained in an instruction file, it translates those directives into executable operations using the permissions already granted to the tool.
Consequently, if an attacker successfully plants a malicious instruction file into the directory from which an agent operates, the agent can be steered into executing unauthorized shell commands, fetching malicious third-party dependencies, or altering local configurations.
Delivery via Silent Browser Downloads and Directory Habits
Although researchers could not verify the exact initial vector that deposited the malicious file on the customer's machine, they highlighted that web browsers can save files into a user's ~/Downloads folder without direct interaction. In their report, Forever Security stated that "~/Downloads is special. It is the one folder the web can write to on its own," adding that "a web page can download a file named AGENTS.md into your Downloads folder, silently."
To demonstrate the feasibility of this staging method, Forever Security created a proof-of-concept webpage. BleepingComputer verified the demonstration page, confirming that it automatically downloaded an AGENTS.md file containing benign text strings without prompting for confirmation. Popular web browsers, including Google Chrome, Microsoft Edge, and Mozilla Firefox, save files directly to the Downloads directory by default, although they display download notifications. By contrast, alternative browsers tested, such as Brave, prompted the user to explicitly approve the download.
Once dropped into the directory, the attack relies on the developer initiating an AI coding session directly within that folder. Forever Security researcher Gal Weizman explained that launching AI assistants within ~/Downloads is a common practice among users who leverage agents to organize files or analyze recently downloaded projects.
Weizman reported that internal telemetry from Forever Security showed hundreds of customers running AI tools—including Claude Code, OpenAI Codex, and Cursor CLI—from their ~/Downloads folders. According to the researcher, Claude Code alone logged more than 1,300 sessions launched from that specific location.
Empirical Tests: Code Execution and Token Exfiltration
To evaluate the severity of the technique, Forever Security researchers reconstructed the attack against two prominent AI coding assistants in controlled testing environments.
OpenAI Codex Testing
Researchers evaluated a reconstructed attack chain against OpenAI Codex using a benign payload designed to open the operating system's calculator application. In these tests, the researchers observed a 90% success rate in inducing the agent to execute the specified command.
Claude Code Testing
In a separate experiment, researchers utilized a malicious CLAUDE.md file to redirect Claude Code's API communication to an attacker-controlled external server. This redirection exposed the agent's OAuth authentication token. The researchers reported that the external server could subsequently impersonate the model and return tool calls, successfully executing code on the client machine in approximately 50% of test runs.
Mitigation: Securing AI Coding Agent Workspaces
Researchers emphasized that because this attack path combines intentional web browser download behavior with intended AI agent instruction-following design, the burden of protection falls primarily on developers and systems administrators.
Both OpenAI and Anthropic provide guidance regarding the safe operation of coding assistants, advising users to maintain strict directory isolation:
- Scope Working Directories Strictly: Avoid launching AI coding assistants from generalized folders such as
~/Downloadsor a user's root home directory. Start agents exclusively in the specific root directory of the software project they are intended to modify. - Enforce Working Boundaries: Keeping the agent's workspace scoped to an individual project establishes a restricted filesystem boundary, preventing the tool from loading unexpected files stored in other locations.
- Audit Instruction Files: Carefully inspect any unfamiliar
AGENTS.md,CLAUDE.md, or related configuration files before authorizing an AI agent to execute project instructions. - Retain Interactive Safeguards: Keep approval prompts, human-in-the-loop confirmations, and sandbox protections active rather than allowing fully autonomous execution without oversight.
- Isolate Untrusted Code: When testing unfamiliar repositories or untrusted scripts, execute the workloads within an isolated virtual environment or dedicated container before introducing them to primary workstations.
Frequently Asked Questions
What is an AGENTS.md file?
An AGENTS.md file is a plain-text markdown file that provides project-specific instructions to AI coding agents. It typically outlines build processes, test commands, tool selections, and code formatting rules for automated development tools.
Why did the AI coding agent execute malicious commands from the Downloads folder?
AI coding assistants automatically check their current working directory for applicable instruction files to determine how to operate. When a user launches an agent inside ~/Downloads, the agent interprets any configuration file present in that folder as authoritative instructions, executing actions with its available tool permissions.
Can AI model providers patch this behavior in their software?
Researchers from Forever Security indicated that there is no software vulnerability for AI vendors to patch, as the agents are functioning as designed by discovering and following configuration instructions in their assigned workspace.
How can developers prevent AI coding agents from being hijacked?
Developers should avoid using ~/Downloads or broad system folders as an agent's working directory. OpenAI and Anthropic advise launching AI coding agents solely within the specific root directory of the target project, reviewing unfamiliar instruction files, maintaining sandbox protections, and requiring confirmation prompts for tool executions.
0 Comments