BleepingComputer (October 25) and Help Net Security (October 26) report research from Forever Security showing a simple weakness: AI coding agents automatically read instruction files in their working directory, and many users run them from ~/Downloads.
What was found
- In a customer environment, a malicious AGENTS.md in Downloads caused a coding agent to try to install a rogue npm package named “function-color”.
- OpenAI Codex: a harmless payload (opening the calculator) succeeded in 90% of tests.
- Claude Code: a malicious CLAUDE.md redirected API traffic to a researcher-controlled server, exposing the OAuth token; the server could then return tool calls that executed code in roughly 50% of tests.
- Exposure: Forever says hundreds of its customers run agents such as Claude Code, Codex and Cursor CLI from Downloads; Claude Code alone launched more than 1,300 sessions from that location.
- Delivery: the researchers could not determine how the file arrived. They say a malicious web page could silently drop one: Chrome, Edge and Firefox save to Downloads by default with a notification, while Brave prompts for approval.
Vendor position
The researchers argue there is nothing to patch because the agents behave as designed. BleepingComputer reports no vendor statement.
What to do
- Never launch an agent from Downloads, your home directory or another broad folder. Start it in the specific project root.
- Review unfamiliar AGENTS.md, CLAUDE.md and similar files before an agent reads them.
- Keep approval prompts and sandboxing on; do not auto-approve commands.
- Test untrusted code in an isolated environment, and apply least-privilege credentials to agents.
Where to be skeptical
- These are the researchers’ tests; success rates depend on versions, settings and permission modes, and a related Hacker News summary describes the figures slightly differently.
- The attack needs a file to land in a folder the agent uses, which is a real but conditional step.
- “Not a bug” is a design stance, not a safety guarantee: it shifts responsibility to users and admins.
Takeaway
Treat agent instruction files as executable input. For organizations rolling out coding agents, working-directory policy and approval settings matter as much as the model.
