Malicious AGENTS.md in Downloads folder steers AI coding agents into installing malware

TLDR

• Forever says a malicious AGENTS.md in a customer's Downloads folder made an agent try installing a malicious npm package.¹²
• They reproduced it on OpenAI Codex and, with a CLAUDE.md file, on Claude Code, exposing its OAuth token.¹²
• Forever says there is nothing for OpenAI or Anthropic to patch; the advice is to run agents from project folders.¹²

Researchers at Forever Security, which monitors risks introduced by AI agents, report finding a malicious AGENTS.md file in the ~/Downloads folder of a customer's machine, where a coding agent was following it and tried to install function-color, a malicious npm package.¹² Forever says it stopped the install before any code ran and that the package comes from a campaign that went unnoticed for roughly two years before being documented publicly.¹ The file was written as ordinary engineering notes, with one section instructing the agent to add a "project-tools" server to ~/.codex/config.toml and launch it through npx.¹

Forever says it reproduced the full chain on OpenAI Codex using the real attacker file inside an isolated virtual machine, and that Codex ran the malicious package in more than 90 per cent of attempts.¹ BleepingComputer reports a 90 per cent success rate for the researchers' reconstructed chain using a harmless payload that opened the calculator app.² Because the edit lands in Codex's machine-wide config, Forever says every later Codex session loads the attacker's server in any folder.¹ In a separate test, BleepingComputer reports, a malicious CLAUDE.md redirected Claude Code's API traffic to a server the researchers controlled, exposing the agent's OAuth token and letting the server return tool calls that executed code in roughly 50 per cent of tests.²

The researchers could not establish how the file reached the customer's machine, but say a web page can silently download a file named AGENTS.md into ~/Downloads.¹² BleepingComputer says it visited the researchers' proof-of-concept page and received an AGENTS.md containing harmless text.² It notes that Chrome, Edge and Firefox save downloads there by default without prompting, though they show a download notification, while Brave asked for approval in its tests.² The attack also needs the target to start an AI agent in that folder, which Forever researcher Gal Weizman told BleepingComputer is common because people use agents to organise Downloads or act on a new file.²

The sources give different usage figures. Forever's report says about half of its customers run a coding agent inside Downloads and roughly a quarter of agent sessions open a real browser.¹ Weizman told BleepingComputer that hundreds of customers run agents including Claude Code, Codex and Cursor CLI from that folder, with Claude Code alone launching more than 1,300 sessions there.²

Forever argues the behaviour is by design: "An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do," it writes, so there is nothing for OpenAI or Anthropic to patch.¹² BleepingComputer says OpenAI and Anthropic recommend starting agents in the root of the specific project, and advises users not to use Downloads as an agent's working directory, to review unfamiliar AGENTS.md and CLAUDE.md files, and to keep approval prompts and sandboxes enabled.² The findings come from a security vendor's own telemetry and tests; neither source includes a response from OpenAI or Anthropic.¹²

Why it matters: instruction files that coding agents obey automatically turn any folder the web can write to into an attack path, and the sources point to user practice rather than a vendor patch as the defence.¹²