Researchers found a malicious AgentS markdown instruction file in a client’s Downloads folder that tricked the AI code agent into installing rogue npm packages.
They reproduced the attack against OpenAI Codex and demonstrated related techniques against Claude Code to leak OAuth tokens and hijack accounts using only malicious instructions.
Markdown files such as AGENTS.md are plain text files that contain project-specific instructions for coding AI agents such as tools to use, how to run tests, and coding conventions to follow.
Agents follow dangerous instructions
Researchers at Forever Security, a company that monitors the risks presented by AI agents and automated software, discovered a trick on a customer’s computer, where encryption agents tried to install malicious npm packages.Color function.’
The investigation tracked an AI agent’s attempt to install a malicious npm package into the AGENTS.md file in the client’s ~/Downloads folder, which serves as the agent’s working directory.
Agents will automatically load the relevant files from their working directory and use the instructions provided in their instructions.
While these files are not executable, the malicious instructions contained in them can lead to AI agents running commands, installing packages, or changing settings using the tools and permissions available to them.
“There is nothing here for OpenAI or Anthropic to fix. The agent that follows AGENTS.md in its folder is doing what it was created to do,” The researchers said.
The researchers’ tests confirmed that attackers can use the files to manipulate the OpenAI Codex and Claude Code into code execution or identity theft.
Although the researchers were unable to determine how the malicious instruction file got into the target’s ~/Downloads location, they explained to BleepingComputer that simply visiting the malicious page can drop the payload without any user interaction.
In a report this week, Forever Security says “~/Downloads is special. It’s the only folder the web can write itself,” and that “web pages can download a file named AGENTS.md into your downloads folder, silently.”
The researchers created a proof-of-concept (PoC) to demonstrate that an attacker can insert malicious files into the ~/Downloads location without the user noticing.
Once the BleepingComputer has checked PoC pageIt downloaded the AGENTS.md file with harmless content, namely the lines “sensitive information here” and “line 2.”
By default, many popular browsers, including Chrome, Edge, and Firefox, save files downloaded from the Web in the user’s ~/Downloads directory without prompting them to choose a save location for each download.
BleepingComputer’s tests on other browsers, such as Brave, prompted the user to approve the download, which should be enough to alert the user that the file has been downloaded.
However, Chrome, Edge, and Firefox display download notifications by default, notifying users when a file is saved locally.
After dropping the file into Downloads, the attacker will require the target to launch their AI agent in that same directory so that it can load the instruction file and digest its malicious instructions.
Forever researcher Gal Weizman told BleepingComputer that this is a common practice, as people often use AI agents to organize that folder or deal with newly downloaded files.
Weizman says internal statistics show that hundreds of customers run AI agents, including Claude Code, OpenAI Codex, and Cursor CLI, from their ~/Downloads folder. Claude Code alone launched more than 1,300 sessions from that site, researchers told BleepingComputer.
Tests show that the attack is possible
The researchers tested their newly created attack chain against Codex using a harmless payload that simply opened a calculator app, recording a 90% success rate.
In a separate test, they used a malicious CLAUDE.md file to redirect Claude Code’s API to a server they controlled. This exposes the agent’s OAuth token, allowing the server to impersonate the model and return a call to the tool that executes the code in about 50% of the tests.
The researchers said that the risk is a combination of the browser’s purpose and the behavior of the agent, which leads to caution and prevention of responsibility directly to the user.
Users should avoid setting ~/Downloads as the AI code agent’s working directory because the location may contain untrusted files that the agent could interpret as instructions.
OpenAI and Anthropic recommend running their AI code agents from the project directory they intend to run.
Keeping the working directory in the relevant project scope helps the agent to have the right context and limit its scope of work, reducing the risk of unreliable processing of files in unrelated locations.
The general recommendation from OpenAI and Anthropic is to start the AI coding agent in the root of the specific project it is supposed to run, rather than in your home directory or a broader parent directory. Keep your workspace as narrow as possible, and expand access only when necessary.
The key idea is that the working directory defines the initial project context of the agent and, depending on the tool, helps to establish its file system access scope.
Users should review unfamiliar AGENTS.md, CLAUDE.md, and similar instruction files before allowing agent AI code to track them, maintain approval warnings and sandbox protection, and test untrusted code in an isolated environment before running it on their main system.
Overall defense scores can hide what happens after initial access. When attackers are using valid credentials, defenses are greatly reduced.
The Blue Report 2026 measures defense technique by technique across 338 million simulations run in customer production environments.
