Rogue AGENTS.md File in Downloads Folder Tricked AI Agents

How a markdown file became an executable vector

Software developers have long treated markdown files as harmless plain text. That assumption just broke down. Cybersecurity firm Forever Security detected a live intrusion on an enterprise endpoint where an AGENTS.md file planted inside the local Downloads folder hijacked an autonomous coding assistant.

The attack relies on a simple architectural blind spot. Coding tools like Claude Code and OpenAI Codex scan their working directory for instruction files such as AGENTS.md to understand project workflows, style guides, and environment scripts. In this incident, the rogue markdown file masqueraded as standard engineering documentation but contained explicit instructions forcing the agent to pull a malicious npm package named 'function-color' and exfiltrate active session tokens.

Because modern web browsers can drop certain non-executable files into the default ~/Downloads directory without an explicit confirmation click, a compromised website can quietly seed instructions on a developer's machine. The moment a user spins up an agent inside that dirty directory, the system-level permissions granted to the AI kick in.

Why vendors cannot patch this with a simple update

The most unsettling aspect of the AGENTS.md exploit is that nothing technically broke. The AI agents behaved exactly as built: they ingested local documentation, trusted the context, and executed shell commands to fulfill the instructions. Forever Security verified that both Claude Code and OpenAI Codex dutifully fell for the attack under identical conditions.

Security models designed for human developers assume someone will inspect code before running an npm install. AI agents invert that logic by automating execution. The shift toward giving autonomous tools full workspace access—a trend highlighted by projects where services like 1Password let AI agents log in without seeing passwords—creates massive exposure when context-reading capabilities are weaponized.

Because the flaw is structural rather than a memory leak or an unhandled exception, model providers cannot issue a straightforward patch. Restricting agents from reading markdown files would dismantle the context mechanism that makes them useful in the first place.

Securing your environment against rogue agent instructions

Until agent developers build stricter origin checks, developers must enforce strict operational boundaries to avoid cross-pollinating untrusted web data with autonomous tools.

Security teams recommend auditing active workspace configurations immediately. If an agent executes an unauthorized package installation or reaches out to an unfamiliar endpoint, assume all active session tokens and local environment variables are compromised.

• Never run an AI agent command directly inside ~/Downloads or any directory shared with web browser outputs.
• Inspect cloned repositories and subdirectories for unfamiliar instruction files like AGENTS.md or CLAUDE.md before invoking an agent.
• Check project settings files like .claude/settings.json for unauthorized proxies, custom base URLs, or altered execution gates.
• Retain manual execution prompts for bash scripts and package installations rather than granting full auto-approval privileges.

What it means for you

Any developer in the US, UK, or EU working with CLI-based coding agents like Claude Code or OpenAI Codex is immediately affected by this threat model. It requires no targeted network breach—visiting a compromised website that triggers a silent download is enough to plant the file. If you run agents on your local machine, check your default downloads folder and verify that automatic script execution gates remain turned on.