A downloaded AGENTS.md file can redirect AI coding agents
Researchers at Forever Security have demonstrated an attack technique in which an AI coding agent treats a downloaded AGENTS.md or CLAUDE.md file as trusted project guidance. In tests involving OpenAI Codex and Claude Code, malicious instructions led to code execution, package installation and credential exposure. The immediate practical impact is not a software patching exercise: users and businesses need to control which directories agents can access and inspect instruction files before allowing them to run.
The technique depends on the way these agents process their working directory. Files such as AGENTS.md contain instructions about tools, tests and coding conventions, and agents automatically load applicable files from that directory. A file does not need to be executable to be dangerous: its text can tell an agent to run commands, install an npm package or change settings using the permissions already available to the agent.
The Downloads folder is a particularly risky location because browsers may save files there automatically. The researchers said a malicious web page could place an AGENTS.md file in that folder without an additional choice of save location. That alone does not complete the attack. The user must subsequently start the AI coding agent in Downloads, where the agent can read and follow the file. The report says this is a realistic workflow because some people use agents to organize downloaded files or work on newly downloaded content.
The demonstrated consequences went beyond unwanted file changes. In a Codex test, a harmless payload opened the calculator application, while a separate Claude Code test redirected API traffic to a server controlled by the researchers. That exposed an OAuth token and allowed the server to impersonate the model and return tool calls that executed code. The reported success rates were 90% for the Codex calculator test and roughly 50% for the Claude Code credential-and-code-execution test, so these figures describe the researchers' reconstructed demonstrations rather than a universal attack rate.
The evidence also limits what can be concluded. Researchers could not determine how the file reached the affected customer's Downloads folder, and the attack requires the agent to be launched from the directory containing the malicious instructions. The report describes the issue as a combination of intended browser and agent behavior, rather than a conventional flaw that OpenAI or Anthropic can simply repair with a vendor patch.
For users, the supported mitigation is to avoid using ~/Downloads as an AI coding agent's working directory. Start the agent in the root of the specific project it is meant to handle, keep that working area as narrow as practical, and expand access only when needed. Review unfamiliar AGENTS.md, CLAUDE.md and similar files before accepting their instructions, leave approval prompts and sandbox protections enabled, and use an isolated environment for potentially untrusted code. These steps reduce exposure, but they do not make untrusted instructions safe by themselves.