A rogue AGENTS.md file in Downloads can hijack your coding agent

Forever Security published research on 22 October showing that a file named AGENTS.md, planted silently in a user’s Downloads folder, can hijack an AI coding agent launched from that directory. Downloads is the one folder a webpage can write to without asking, and agents like OpenAI Codex and Anthropic’s Claude Code automatically read and trust whatever instructions sit in their working directory, no click required.

In the firm’s tests, the planted file got Codex to install a malicious npm package in more than 90% of attempts, and got Claude Code to leak its OAuth token in roughly half of them, by rewriting config files such as ~/.codex/config.toml or .claude/settings.json. Cursor CLI was also affected. Neither OpenAI nor Anthropic has shipped a patch, because, as the researchers put it, the agent is doing exactly what it was built to do: follow the instructions it finds in its own working directory.

Why it matters: if you ever open a downloaded zip, extract a repo, or otherwise point an agent at ~/Downloads, check that folder for an unexpected AGENTS.md or CLAUDE.md first. The recommended fix is behavioural, not a version bump: never launch an agent from Downloads, and watch its config for API endpoints or MCP servers you didn’t add.

The caveat: this isn’t a bug vendors can patch away. It’s a consequence of agents treating local instruction files as trusted by design.