AI coding agents hijacked using AGENTS.md file in Downloads folder

Why it matters

Forever Security researchers discovered that a plain-text AGENTS.md instruction file sitting in a customer's Downloads folder caused an AI coding agent to try installing a rogue npm package. Because agents automatically load instruction files from their working directory, malicious commands embedded in such files can steer them to run commands, install packages, or change settings using the tools and permissions they already have. The researchers reproduced the attack against OpenAI Codex, achieving a high success rate executing a harmless payload, and used a related CLAUDE.md technique against Claude Code to expose OAuth tokens and hijack the account in about half of tests. The delivery vector is notable: browsers commonly save downloads to the Downloads folder without asking, so a malicious page can silently drop an AGENTS.md file there. The attack then requires the user to launch an agent in that directory, which Forever Security says is common practice. The researchers argue there is nothing for OpenAI or Anthropic to patch, since agents behaving as designed are the problem, and both vendors advise running agents only in their intended project directories.