How Malicious AGENTS.md Files Hijack AI Coding Agents
Security researchers have revealed a subtle attack vector where rogue instruction files left in local directories can manipulate autonomous developer tools. In a recent finding by Forever Security, an automated coding assistant was caught attempting to install a malicious npm package named function-color on a developer computer. The attack did not exploit an operating system zero-day or a vulnerability in an underlying model. Instead, it was triggered by a rogue AGENTS.md configuration file sitting quietly inside the user’s ~/Downloads directory, which also happened to be the agent’s current working directory.
This development exposes an urgent blind spot for software engineering teams that integrate AI-powered CLI tools directly into their everyday workstations. Coding agents such as OpenAI Codex, Claude Code, and Cursor CLI are designed to inspect their local workspace, ingest configuration rules, and execute terminal commands autonomously on behalf of the developer. When these tools are pointed at broad, unvetted directories, malicious instructions written in plain text can silently subvert the local environment and trigger untrusted software installations.
For technical leaders and development teams, the incident marks an important inflection point in local workflow security. AI agents treat local instruction files as explicit context rather than untrusted external input. Understanding how these instruction files function, how drive-by web behavior places files into default locations, and how teams can restrict their local agent execution scopes is now an essential part of engineering hygiene.
How Markdown Instruction Files Control Agent Execution
Modern AI coding workflows rely heavily on markdown instruction files such as AGENTS.md and CLAUDE.md. These plain-text files sit inside a repository or working directory to provide project-specific guidance for AI tools. They describe the preferred testing frameworks, list common terminal commands, outline coding conventions, and designate which tools the assistant should use. Because language models perform better when supplied with structured project context, these instruction files have become standard fixtures in autonomous software engineering setups.
When a developer initializes an AI coding assistant, the tool automatically scans its active working directory for applicable instruction files. The agent parses the markdown text and incorporates the directives into its internal system instructions. While these markdown files are not executable binaries, the instructions they contain hold immense operational power. Because the agent possesses system permissions to run bash commands, manage files, install dependencies, and manipulate project settings, any instruction accepted by the agent can immediately translate into real operating system actions.
The Downloads Folder as an Unauthenticated Attack Surface
The primary challenge in this attack vector is how a malicious instruction file reaches a developer computer in the first place. As highlighted by researchers at Forever Security, the ~/Downloads folder is distinct because it is the single directory that the modern web can write to on its own. In proof-of-concept demonstrations, visiting an untrusted web page allowed an attacker to silently drop an AGENTS.md payload directly into the user’s default downloads location without requiring manual confirmation.
This behavior stems directly from default web browser configurations. Major browsers like Chrome, Edge, and Firefox automatically save downloaded assets directly into ~/Downloads without prompting the user to select a destination path for each individual file, even though they display default download notifications. Other browsers, such as Brave, require users to approve incoming downloads before writing files to disk. Once an attacker drops a malicious instruction file into the default directory, the exploit chain simply waits for the developer to run an agent in that exact folder.
Launching agents directly inside ~/Downloads is surprisingly widespread among software teams. According to Forever Security researcher Gal Weizman, developers routinely launch agents in their downloads directory to tidy up cluttered files or to perform rapid analysis on newly downloaded archives. Internal telemetry from Forever Security indicated that hundreds of customer users have run AI tools like Claude Code, OpenAI Codex, and Cursor CLI directly from ~/Downloads. In the case of Claude Code alone, researchers observed more than 1,300 separate sessions initiated within that directory.
Demonstrated Impact: Arbitrary Execution and Token Theft
To confirm the feasibility of the threat, researchers reconstructed the attack path against popular coding assistants. In testing against OpenAI Codex, researchers used a benign payload designed to launch the local calculator application. Codex followed the rogue markdown instructions and executed the command with a 90% success rate. The agent parsed the instructions from the local directory and executed the command via its local toolchain without triggering internal model safety boundaries.
The implications for credential theft are even more severe. In a separate experiment against Claude Code using a modified CLAUDE.md file, researchers instructed the tool to redirect its API traffic to an attacker-controlled external server. This redirection exposed the agent’s active OAuth token, giving the rogue server the ability to impersonate the model. In approximately 50% of test runs, the rogue server successfully returned fabricated tool calls that executed arbitrary code on the target host.
This level of compromise creates severe downstream risks for engineering organizations. According to industry data from The Blue Report 2026, once attackers obtain valid credentials, only 37% of their subsequent actions are blocked by standard security controls. When an AI agent leaks an OAuth token or installs an unauthorized package like function-color, attackers bypass typical perimeter defenses and operate with the full trust profile of a validated developer workstation.
The Shared Responsibility Boundary in Local AI Tooling
A critical reality of this vulnerability is that model vendors cannot simply ship a software patch to resolve it. As Forever Security noted, an autonomous agent that reads an AGENTS.md file in its current working directory and executes the requested instructions is functioning exactly as it was designed to do. The problem lies at the intersection of default browser download mechanisms, broad file system privileges, and unverified prompt ingestion.
Both OpenAI and Anthropic advise that AI coding agents should be launched strictly within the root directory of the specific project they are assigned to work on. Starting an agent within a generic directory like ~/Downloads or a broad home directory conflates untrusted, drive-by web downloads with legitimate project files. Because the working directory acts as the agent’s primary context and file boundary, scoping the agent strictly to a dedicated project repository drastically limits its exposure to unvetted files.
Practical Takeaways for Securing Local Agent Workflows
Securing engineering workstations against rogue instruction injection requires practical changes to developer habits, browser settings, and local execution boundaries. Teams should enforce the following defensive practices across all developer environments:
- Never launch AI coding assistants from generic folders such as
~/Downloads, the desktop, or the user root directory; restrict execution strictly to isolated project repositories. - Configure web browsers to prompt for a specific destination path before saving any download, mitigating silent drive-by file drops.
- Audit and inspect all incoming repository files, including
AGENTS.mdandCLAUDE.md, prior to opening them with autonomous coding agents. - Retain human approval prompts for all bash executions, package installations, and system modifications within CLI agents rather than running in fully autonomous modes.
- Execute local AI assistants within sandboxed virtual machines, restricted containers, or ephemeral development environments that lack access to host OAuth tokens and system credentials.
Planning something like this? XORGEEK designs and builds web and mobile apps for teams in Japan and around the world. Talk to us.
Sources
Photo by Philipp Katzenberger on Unsplash
