Malicious AGENTS.md file hijacks AI coding agents, researchers find
Forever Security reproduced the attack on OpenAI Codex, which opened the calculator in about 90% of tests, and on Claude Code, which leaked an OAuth token.
Researchers at Forever Security reported that a malicious AGENTS.md file sitting in a customer's Downloads folder tried to make an AI coding agent install the rogue npm package 'function-color', according to BleepingComputer. The company reproduced the technique against OpenAI Codex, which opened the calculator app in about 90% of tests.
The team also demonstrated a related attack using a malicious CLAUDE.md file that redirected Claude Code API traffic to a server they controlled. In that test the OAuth token was exposed, and the server executed tool calls in roughly 50% of tests.
Forever Security published a proof-of-concept page that silently downloads an AGENTS.md file into the Downloads folder. Markdown files such as AGENTS.md carry project-specific instructions for AI coding agents, including which tools to use, test commands and coding conventions, and agents load applicable files from their working directory automatically.
Internal statistics cited by the researchers show hundreds of customers running agents such as Claude Code, OpenAI Codex and Cursor CLI from their ~/Downloads folders, including more than 1,300 Claude Code sessions launched from that location. The researchers said they could not determine how the malicious instruction file reached the target's Downloads folder.
No patch expected
According to the researchers, there is nothing for OpenAI or Anthropic to patch, because the agent is doing what it was designed to do. Their advice is not to set ~/Downloads as an AI coding agent's working directory.
Browsers including Chrome, Edge and Firefox save downloaded files to ~/Downloads without prompting for a location, while Brave asks the user to approve downloads.
Quick answers
What is the AGENTS.md attack?
A malicious AGENTS.md file in the Downloads folder instructs an AI coding agent to install a rogue npm package, such as 'function-color', when the agent is run from that directory.
Do OpenAI or Anthropic need to release a patch?
The Forever Security researchers said there is nothing for OpenAI or Anthropic to patch, because the agent is doing what it was designed to do.
How can users avoid it?
The researchers advised users not to set ~/Downloads as an AI coding agent's working directory.