Threat
AI coding agents hijacked using AGENTS.md file in Downloads folder
First reported bleepingcomputer.com
Page published · Page updated
Earliest dated coverage: 25 Oct 2026 · First observed: 25 Oct 2026 · Latest dated coverage: 25 Oct 2026
Coverage timeline
Why it matters
Malicious AGENTS.md files in download directories can exploit coding agents' automatic instruction loading to trigger package installation, credential theft, and account takeover using the agents' existing permissions.
Forever Security found a malicious AGENTS.md file in a customer's Downloads directory that caused a coding agent to attempt installation of the rogue npm package function-color. Researchers reproduced the attack against OpenAI Codex and demonstrated a related Claude Code technique for OAuth-token theft and account hijacking. How the original malicious file reached the customer's machine remains unknown.
Summary
Forever Security reportedly discovered a malicious AGENTS.md instruction file in a customer's ~/Downloads directory after an AI coding agent attempted to install the malicious npm package function-color. Downloads was also the agent's working directory, allowing the file to enter its instruction context. The reported customer outcome is an attempted installation—not a confirmed completed installation, subsequent malware execution, or account takeover.[0]
The exposure arises when downloaded content becomes agent instructions. AGENTS.md and similar Markdown files are not executable themselves, but coding agents can follow their contents by running commands, installing packages, or changing settings through available tools and permissions. The original file's delivery route remains unknown. A separate browser demonstration showed that a web page could download a harmless AGENTS.md file, illustrating a possible route rather than establishing what happened to the customer.[0]
Researcher testing demonstrated two distinct outcomes: a reconstructed Codex attack launched a calculator in 90% of tests, while a separate Claude Code technique redirected API traffic to a researcher-controlled server, exposed an OAuth token, and enabled model-impersonating tool calls that executed code in roughly 50% of tests. These are reported experimental results, not evidence of equivalent success rates or credential theft in customer environments.[0]
The researchers described the issue as an interaction between intended browser download behavior and intended agent instruction handling, not a conventional patchable defect. The incident-specific defensive priority is therefore to prevent untrusted download directories from becoming agent instruction contexts: launch agents within the intended project, review unfamiliar instruction files, and retain approval and sandbox protections.[0]
Attack chain
- 1. Malicious instruction file present: A malicious AGENTS.md file was found in the customer's ~/Downloads directory. The researchers could not determine how it arrived, so browser delivery is not established for this incident.[0]
- 2. Working-directory instruction loading: The coding agent operated with ~/Downloads as its working directory. The investigation traced its behavior to the AGENTS.md file there; applicable instruction files are automatically loaded to guide agent actions.[0]
- 3. Attempted malicious package installation: The agent attempted to install the npm package function-color, which the report identifies as malicious. The supplied account does not establish that installation completed or document subsequent customer-system execution.[0]
Disclosure timeline
| Date | Event |
|---|---|
| 2026-10-25 | BleepingComputer published its account of the customer discovery, the unknown original delivery route, browser download testing, and Forever Security's Codex and Claude Code demonstrations.[0] |
How it works
Instruction-file authority is the central mechanism. Files such as AGENTS.md normally provide project-specific directions, including tool selection, test procedures, and coding conventions. When an applicable file contains malicious directions, an agent can translate that text into actions using its existing tools and permissions. The Markdown file itself does not need to be executable.[0]
The Downloads working directory creates the relevant trust overlap: it receives externally supplied files and can also become the location from which an agent loads instructions. For the described attack to trigger, the target must run the agent in that directory so it encounters the instruction file. The article reports this exact working-directory condition in the customer incident.[0]
Browser-assisted placement was demonstrated separately from the incident. BleepingComputer tested a page that downloaded an AGENTS.md file containing harmless text. The article distinguishes saving without a location-selection prompt from an entirely invisible download: Chrome, Edge, and Firefox display download notifications by default, while Brave requested approval in the publication's tests.[0]
The reconstructed Codex test replaced a malicious outcome with a calculator launch and reportedly achieved 90% success. This demonstrates that instruction-file influence could reach command execution in the tested setup; it does not establish that the observed customer's package installation succeeded.[0]
The Claude Code demonstration used a malicious CLAUDE.md file to redirect API traffic to a server controlled by the researchers. That server received the agent's OAuth token and could impersonate the model by returning tool calls. Code execution occurred in roughly 50% of tests. The supplied account presents this as a separate demonstration, not as an observed stage of the customer incident.[0]
The researchers explicitly characterized following an instruction file in the agent's folder as intended behavior. Their assessment places the principal preventive boundary around trusted working directories and reviewed instructions rather than identifying a fixed software release.[0]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| OpenAI Codex | The reconstructed test used an instruction file in the agent's working directory and demonstrated calculator execution. No tested release number or affected version range is specified. | No fixed release is identified in the supplied report. The researchers describe instruction-file loading in this setting as intended behavior rather than a conventional patchable defect.[0] |
| Anthropic Claude Code | A separate test used CLAUDE.md instructions to redirect API traffic, expose an OAuth token, and induce tool-call execution. No tested release number or affected version range is specified. | No fixed release is identified in the supplied report. The researchers characterize the enabling behavior as intended functionality and emphasize user-side precautions.[0] |
Indicators of Compromise
| Type | Indicator | Context |
|---|---|---|
| other | function-color | Name of the npm package identified as malicious in the reported customer incident. Hunt for attempted or completed installation of this package; the reported observation was an installation attempt.[0] |
| file-path | ~/Downloads/AGENTS.md | Location of the malicious instruction file found in the customer incident. This is a contextual investigative lead, not a standalone malicious signature: AGENTS.md is also a legitimate agent instruction filename, so inspect contents and provenance.[0] |
Key takeaways
- Working-directory selection is security-relevant: a directory populated by web downloads can also supply instructions that an agent automatically follows.[0]
- Keep the evidence boundaries clear. The customer incident establishes a malicious instruction file and an attempted package installation; the original delivery route remains unknown, and OAuth-token exposure was demonstrated separately by researchers.[0]
- The reported 90% Codex and roughly 50% Claude Code results concern different researcher demonstrations and outcomes. They should not be treated as measured compromise rates across deployed customer environments.[0]
- The report identifies no fixed release to deploy. Its practical recommendations center on project-scoped execution, instruction-file review, approval prompts, sandboxing, and isolation.[0]
Defensive actions
- Launch coding agents from the intended project's root rather than ~/Downloads, the home directory, or a broad parent directory.: The incident depended on Downloads also being the agent's working directory. The article attributes project-root guidance to OpenAI and Anthropic and recommends keeping the working scope as narrow as practical.[0]
- Review unfamiliar AGENTS.md, CLAUDE.md, and comparable instruction files before allowing an agent to follow them.: These files can influence command execution, package installation, and settings changes despite being plain text. The customer incident and both researcher demonstrations relied on malicious instruction content.[0]
- Keep agent approval prompts and sandbox protections enabled.: The article specifically recommends retaining these controls because instruction-file content can lead an agent to exercise its available tools and permissions.[0]
- Test potentially untrusted code in an isolated environment before running it on the main system.: The report recommends isolation, and the observed attempted npm installation shows how an instruction file can lead an agent toward execution of externally supplied software.[0]
- Investigate function-color installation activity together with instruction files in the agent's working directory, particularly ~/Downloads/AGENTS.md.: The reported investigation connected the package-installation attempt to that instruction file. Reviewing the attempted action alongside its instruction context follows the concrete relationship established in the incident.[0]