AGENTS.md in Downloads hijacks Codex and Claude Code

A file named AGENTS.md sitting in your Downloads folder can take over an AI coding agent. Researchers at Forever Security found one on a customer's machine after a coding agent, launched from ~/Downloads, tried to install a malicious npm package called function-color. The AGENTS.md Downloads hijack needs no exploit and no bug. It uses two features working as designed: browsers save files to Downloads, and agents read instruction files from their working directory. Nobody is going to patch this for you.

What actually happened

BleepingComputer reported the research on October 25. The key details:

• The delivery. A web page can save a file called AGENTS.md into Downloads. Chrome, Edge and Firefox do this by default with only a notification. Brave asks first. The researchers did not find out how the file reached the customer's machine.
• The trigger. The user starts an agent with Downloads as the working directory, often to sort files or act on something they just downloaded. The agent loads AGENTS.md as instructions and carries them out with the tools and permissions it already has.
• Codex. The researchers reproduced the attack against OpenAI Codex with a harmless payload that opened the calculator. It worked about 90% of the time.
• Claude Code. A related technique with a malicious CLAUDE.md redirected the agent's API traffic to a server the researchers controlled. That exposed the OAuth token, and the fake server could send back tool calls that ran code in roughly half of tests.
• Scale. Forever's Gal Weizman said hundreds of its customers run agents from Downloads. Claude Code alone started more than 1,300 sessions there.

There is no CVE and no fix. The researchers say there is "nothing here for OpenAI or Anthropic to patch." Both vendors already tell users to run agents from a specific project directory, not from home or a broad parent folder.

Why the AGENTS.md hijack matters for your business

Instruction files are code now. AGENTS.md and CLAUDE.md are plain text, but an agent with shell access treats them as orders. Any folder where outsiders can drop files is a folder where outsiders can program your agent.

Downloads is the worst folder on the machine. It collects whatever the browser, email and chat apps hand it. It is also where people go to "just clean things up," which is exactly the job people now give to agents.

The blast radius is the laptop. The agent runs as you. It can read your .env files, your SSH keys and your cloud credentials. One bad session is an incident, not a typo.

Sources: BleepingComputer.