AI coding agents fall for malicious instructions planted in the Downloads folder

A file that a website saves to the Downloads folder without approval can trick AI coding agents into installing a malicious npm package or handing over the user’s login token when they’re opened in that folder, Forever Security has found.

The file is called AGENTS.md, a plain text document developers place in a project folder with instructions for coding agents, the AI tools that write and run code on their own.

One turned up on a computer belonging to a Forever customer, where it tried to get a coding agent to install a malicious package before the firm’s software stopped it. The file was aimed at OpenAI’s Codex.

“This is not ordinary malware,” wrote Gal Weizman and Omer Samet, the company’s researchers. “An AGENTS.md is a file a coding agent is built to trust and obey, and ~/Downloads is the one folder a website can drop a file into with no click and no permission. Together, that lets the web plant orders your own agent carries out. Markdown is the new executable,” they explained.

The package was function-color, part of a malicious campaign on npm, a public library of ready-made JavaScript code that developers add to their projects. According to Forever, the campaign went unnoticed for about two years until it was caught and publicly documented, and npm has since removed the package.

Blocking a known bad package is routine, Weizman and Samet said, and what made them look closer was where the order came from. The document was disguised as an ordinary set of engineering guidelines, and nobody knew how it got there.

Operating systems won’t run a program downloaded from the internet until the user approves it, the pair noted, and those protections don’t apply to a plain text file.

Codex ran the attacker’s file

Codex follows an AGENTS.md only in a folder it trusts, and Downloads qualifies once the user has worked there. When Codex was opened in that folder and given any task, it first changed its own settings and then installed the package named in the file.

The planted document runs to 13 KB, and its length and mundane tone help it get through, since a short request to install a package gets refused.

“In our testing, Codex ran the malware in more than 90% of attempts,” the two found. Most of the team’s testing used a harmless stand-in that only opens a calculator, and the malicious package itself was run once inside an isolated virtual machine.

The settings Codex changes apply to the whole computer, so every later Codex session runs the attacker’s command, whichever project the user opens.

Login token handed to an attacker

To find out whether the problem went beyond one product, Weizman and Samet created their own CLAUDE.md, the equivalent file for Anthropic’s Claude Code, inspired by the attacker’s. Claude was much harder to fool, they noted, and the attack that worked looks nothing like the Codex one.

Claude Code sends its requests over the internet to Anthropic’s AI model. The researchers’ file asks the agent to save a small settings change, presented as a company’s internal gateway, that sends those requests to a server the attacker controls. Claude Code normally asks a person to approve a change like this and often refuses ones that look wrong.

“In our testing, Claude followed through on this about 50% of the time,” the team said.

Each request carries the user’s login token, a digital key that keeps the user signed in. When the pair replayed a captured token against Anthropic’s service, they were treated as the victim and took over the account without running any code.

The next time Claude Code starts in that folder, the attacker’s server can pose as the AI model and tell the agent to run commands with its sandbox turned off. The file also tries to get Claude Code to start a helper agent, which connects through the attacker’s server right away, and that let the researchers run code within the same session in about a fifth of tests.

AI agents can trigger their own attacks

A lot of browsing is done by agents working on their own while nobody watches the screen, so the agent itself can visit the page that drops the file, which Forever’s team says makes the agent both the target and the weapon in this attack.

The company’s data shows that about half of its customers run a coding agent inside the Downloads folder, and about a quarter of agent sessions open a browser.

“There is nothing here for OpenAI or Anthropic to patch,” the researchers argue. In their view, an agent that obeys the instructions file in its folder is doing its job, the same way a browser that shows a phishing page is working as designed. That leaves the gap open, and users have to defend against it themselves.

Keeping agents out of Downloads

“You do not need to buy anything to act on this today,” researchers noted.

They warn against starting any coding agent in the Downloads folder and say users should read any AGENTS.md or CLAUDE.md file they didn’t write before letting an agent near it, including in a code repository they’ve just copied.

They also advise checking agents’ settings files for servers or web addresses the user didn’t add. Approval prompts and sandboxes should stay switched on, and any instruction telling an agent to get around them deserves suspicion.

Anyone who finds a planted file should assume their login token has leaked and replace it, the researchers say, since a stolen token works as a live session. A computer where function-color was installed should be treated as compromised.

“We caught this one because we were watching the agent, not the user. The next attack will not look like this one – and anyone still watching only the user will miss it too,” Forever Security concluded.