AI Coding Agents Vulnerable to Malicious AGENTS.md Files in Downloads Folder
Researchers at Forever Security discovered that AI coding agents can be hijacked by malicious instruction files placed in the Downloads folder. A single AGENTS.md file tricked OpenAI Codex into installing a rogue npm package, while a similar technique against Claude Code leaked OAuth tokens. The attack exploits default browser behavior that saves files to Downloads without user prompts, combined with agents automatically loading instructions from their working directory. Tests showed a 90% success rate for executing code via Codex and a 50% success rate for credential theft via Claude Code. Experts advise users to avoid running agents in the Downloads folder and to review unfamiliar instruction files before execution.