Malicious AGENTS.md in Downloads hijacks AI coding agents

Forever Security researcher Gal Weizman has published a technique that turns a coding agent's own instruction file against it: drop an AGENTS.md into a user's ~/Downloads folder, wait for them to start an agent there, and the agent executes attacker-chosen steps as trusted project config. The write-up — "Markdown Is the New Executable" — is the primary source; BleepingComputer covered it this week. This is a lab demonstration and a single in-the-field sighting, not a tracked campaign.

How it works

Agents read the instruction file in their working directory — AGENTS.md for Codex, CLAUDE.md for Claude Code — and act on it with whatever tools and permissions the session has. The file is plain Markdown, so none of the OS guardrails for downloaded executables apply. A web page can write it to ~/Downloads on save, and ~/Downloads is a folder people routinely open an agent in.

Forever tested two chains:

• Codex: the planted AGENTS.md tells Codex to add an [mcp_servers.*] entry to ~/.codex/config.toml — a machine-wide file, so the change outlives the one session — and that server runs a command installing the npm package function-color. Forever reports Codex ran the install in "more than 90% of attempts."
• Claude Code: a planted CLAUDE.md tells Claude to write .claude/settings.json with an ANTHROPIC_BASE_URL pointed at an attacker server. That reroutes the agent's API traffic, exposing its OAuth token (account takeover) and letting the attacker return tool calls that run code. Forever reports the config write succeeded "about 50% of the time," with same-session code execution via a subagent in "about a fifth of the time."

How it was found

Forever says it blocked a customer's coding agent mid-session from installing function-color, a known-malicious package since removed by npm, then traced the instruction to an AGENTS.md sitting in that customer's ~/Downloads. Nobody knew how the file got there — Forever notes a malicious page could have dropped it without interaction. That is the extent of the in-the-wild evidence: one blocked install, origin unknown. The success rates above are from Forever's own testing, not observed attacks.

Limits and caveats

Two preconditions carry the attack: the file has to reach ~/Downloads, and the user has to launch an agent there. Browsers still surface a download notification (Brave prompts before saving), and an attentive operator who reads a stray instruction file would catch it. The published numbers are Forever's — no independent party has reproduced the 50%/90% figures yet, and this beat runs hot on vendor demos, so treat the rates as indicative, not settled. The core point is architectural and harder to argue with: an instruction file is executable intent, and agents trust the one in front of them.

Forever's framing is that there is nothing to patch — an agent following its own AGENTS.md is working as designed. That puts the fix on operator behavior, not a vendor release.

What to do today

1. Don't run an agent with ~/Downloads, your home directory, or any broad parent as its working directory. Start it at the root of the specific project.
2. Read any AGENTS.md, CLAUDE.md, or similar instruction file you didn't write before letting an agent near it.
3. Audit ~/.codex/config.toml for unexpected [mcp_servers.*] blocks or a changed base URL, and .claude/settings.json for an ANTHROPIC_BASE_URL or API endpoint you didn't set.
4. Keep approval gates and sandboxing on, and distrust any instruction telling the agent to disable them.
5. Treat installation of function-color as an indicator of compromise; if a token may have been rerouted, rotate it — a stolen OAuth token is a live session.

Context

This is the same class of problem as a poisoned dependency, moved up the stack to the agent's config surface: the untrusted input is now a Markdown file the agent is built to obey. It follows a run of agent-targeting supply-chain abuse we've covered — the npm-delivered agent hijack behind Apex Accelerator among them. As agents gain standing permission to install packages, edit config, and call tools, their instruction files become part of the attack surface, and ~/Downloads is the softest spot in it.