AI Coding Agents Vulnerable to Malicious AGENTS.md Files in Downloads Folder

Key points

• Forever Security researchers identified a vulnerability where AI coding agents execute malicious commands from AGENTS.md files located in the user's Downloads directory.
• The attack leverages the fact that browsers like Chrome, Edge, and Firefox automatically save downloaded files to the Downloads folder without explicit user approval.
• OpenAI Codex demonstrated a 90% success rate in executing code when presented with a malicious AGENTS.md file in its working directory.
• Claude Code was successfully manipulated to leak OAuth tokens in approximately 50% of tests, allowing attackers to impersonate the model and execute further commands.
• The researchers noted that there is no software patch for this issue, as agents are designed to follow instructions in their working directory; the risk lies in user configuration and browser defaults.
• Internal data from Forever Security indicates that hundreds of customers run AI agents, including Claude Code and Cursor CLI, directly from their Downloads folders, with Claude Code alone launching over 1,300 sessions from that location.

Background

This security finding emerges amid a broader trend of rapid AI agent adoption and associated security concerns. In September 2026, Meta's Muse AI agent experienced a surge in downloads, surpassing ChatGPT in the US market, but faced immediate scrutiny for zero-day vulnerabilities and friction with e-commerce platforms like Amazon. While those earlier issues focused on consumer-facing apps and platform access, the current discovery highlights a distinct risk for developer-focused AI tools, where local file systems and working directories become attack vectors. The previous 'consumer inertia' sell-off and chip stock rallies underscore the market's sensitivity to AI agent capabilities, but the current incident shifts the focus to the security implications of autonomous coding agents interacting with untrusted local files.

Why it matters

This vulnerability exposes a critical gap in the security model of autonomous AI coding agents, which rely on local file contexts for instruction. As developers increasingly use tools like OpenAI Codex and Claude Code to automate workflows, the risk of supply-chain attacks via simple file drops becomes significant. The inability to patch this issue at the vendor level places the burden of security on users, requiring stricter directory scoping and manual review of instruction files. This could lead to widespread credential theft and unauthorized code execution if users continue to run agents in broad directories like Downloads, potentially impacting enterprise security and developer productivity.

What to watch

Users are advised to immediately change their AI agent working directories to specific project roots rather than broad locations like Downloads or home directories. Developers should enable sandbox protections and approval prompts for file operations. Vendors like OpenAI and Anthropic are expected to reinforce guidelines on directory scoping, though no software patches are anticipated since the behavior is intended. Researchers may continue to develop proof-of-concept attacks to highlight the risks of other browser default behaviors, and security firms may update their monitoring tools to detect anomalous AGENTS.md files in common download locations.