Malicious AGENTS.md File Hijacks AI Coding Agents from Downloads

Researchers at Forever Security say a malicious AGENTS.md file in a customer’s Downloads folder led an AI coding agent to try to install a rogue npm package called function-color. The researchers reproduced related attacks against OpenAI Codex and Claude Code.

AI coding agents can load instruction files from their working directory and act on them using their available tools and permissions. The researchers said they could not determine how the file reached the customer’s Downloads folder. They demonstrated a proof of concept in which a web page silently downloaded an AGENTS.md file there. BleepingComputer’s test found the downloaded file contained harmless text.

In tests using harmless payloads, the researchers reported a 90% success rate for their reconstructed Codex attack chain. In a separate Claude Code test, a malicious CLAUDE.md file redirected API traffic to a server controlled by the researchers, exposing an OAuth token. The server then returned tool calls that executed code in roughly 50% of tests.

Forever Security researcher Gal Weizman told BleepingComputer that customers use coding agents from Downloads. He said Claude Code alone had launched more than 1,300 sessions from that folder, according to the company’s internal statistics. The researchers recommend starting agents in the specific project directory they are meant to work on and reviewing unfamiliar instruction files before use.