AGENTS.md Downloads attack: how to check if you're exposed
2026-10-26 · 4 min read
The AGENTS.md Downloads attack works like this: a malicious instructions file lands in your ~/Downloads folder, and a coding agent started in that folder reads it and does what it says. To check whether you're exposed, look for AGENTS.md or CLAUDE.md files you didn't write, look for unfamiliar servers or API addresses in your Codex and Claude Code config, and stop launching agents from Downloads.
The posts that spread it
On Sunday, @BleepinComputer posted its story under the headline "AI coding agents hijacked using AGENTS.md file in Downloads folder." Within about twenty minutes, @lukedewolf quoted it and pointed out that Downloads is the one folder a web page can write to without asking you. He also advised starting agents in the project folder, not Downloads or your home folder, and keeping approval prompts on.
A few hours later @AGTPinsights summed it up as a plain AGENTS.md file that "can hijack AI coding agents." Their post adds that there's no fix coming, which matches the original research.
What Forever Security actually found
The research comes from Gal Weizman and Omer Samet at Forever Security, published October 22 as Markdown Is the New Executable. It started with a real incident. Their tooling stopped a coding agent on a customer's machine from installing function-color, a malicious npm package that had gone undetected for about two years. The instruction to install it came from an AGENTS.md file in the customer's Downloads folder, which was also the agent's working folder. Nobody knows how the file got there.
Two normal behaviors combine to make this work. Agents treat the instructions file in their folder as trusted: Codex reads AGENTS.md and Claude Code reads CLAUDE.md. And browsers let websites save files to Downloads, with the site choosing the name and the contents. Weizman published a harmless proof of concept page, and BleepingComputer confirmed that it drops an AGENTS.md file.
Forever tested both agents:
| Agent | What the planted file asked for | How often it worked |
|---|---|---|
| OpenAI Codex | Add a tool server to ~/.codex/config.toml that installs the package |
Over 90% of attempts |
| Claude Code | Write a project settings file that sends API traffic to the attacker's server | Config write about half the time, code execution about a fifth |
The Codex change is the worse of the two because it lives in the machine-wide config and follows you into every session afterward. On Claude Code, the redirect leaked the user's OAuth token, and the attacker's server could send back tool calls for Claude to run. Forever says Claude was harder to fool. The attack only worked when the file was long and read like boring engineering documentation.
The usage numbers bothered me more than the attack. About half of its customers have someone running a coding agent inside Downloads, and Weizman told BleepingComputer that Claude Code alone started more than 1,300 sessions there. Weizman's explanation is simple: people point agents at Downloads to tidy it up or to work on files they just downloaded.
How to check your machine
These checks are for Mac or Linux.
- Look for stray instruction files:
ls -la ~/Downloads/AGENTS.md ~/Downloads/CLAUDE.md. If one exists and you didn't create it, read it before you do anything else. - Check Codex for servers you didn't add:
grep -n "mcp_servers" ~/.codex/config.toml. Every entry should be one you recognize. - Check Claude Code for a changed API address:
grep -rn "ANTHROPIC_BASE_URL" ~/.claude/settings.json .claude/settings*.json. Unless your company runs its own gateway, this should return nothing. - Look for the known package:
npm ls -g function-color. Forever treats any install of it as a compromised machine.
If any of these turn something up, rotate your Claude and OpenAI logins and API keys first, then clean up. A leaked token gives someone a live session. We covered the rotation steps for a similar case in the LiteLLM 1.107.0 compromise post.
Why nobody is patching it
The researchers say "there is nothing here for OpenAI or Anthropic to patch." Each agent did exactly what it was built to do. BleepingComputer notes that both vendors already tell you to start agents in a specific project folder, not a broad one like your home folder or Downloads. I think that's a fair position, but it puts the work on the user. Approval prompts help only if people read them. Anthropic's auto mode and similar features approve more actions without asking, so the folder you start in matters more than it used to.
What this means for a small business
If anyone on your team uses Codex, Claude Code or Cursor, set a simple rule: agents start inside a project folder, and nobody points one at Downloads. It costs nothing, and it closes the easiest way in. It's the same lesson as Apple's Full Disk Access changes: whatever an agent can reach, it might act on.
If you don't know which of your people run coding agents or what those agents can touch, New Face Design's free process audit is a quick way to find out.