AGENTS.md Downloads Folder Attack: How to Protect Your AI Coding Agents

A web page can silently drop a file named AGENTS.md or CLAUDE.md into your ~/Downloads folder. If you then start an AI coding agent such as OpenAI Codex or Claude Code in that folder, the agent treats the file as trusted project instructions. That can mean installing an npm malware package, adding a rogue MCP server, or sending your API traffic and login token to an attacker. Nothing here is a bug either vendor can patch, so the fix is yours: stop running agents in Downloads, check two config files, and limit what instruction files can change.

This guide covers what the researchers found, where the reports disagree, how each agent actually picks up instruction files (which matters more than the headlines suggest), and the commands to check your machine.

What happened, in order

The technique comes from Forever Security's report by Gal Weizman and Omer Samet, titled "Markdown Is the New Executable". It started as an incident, not a lab exercise: Forever stopped a coding agent on a customer's machine from installing function-color, a known malicious npm package. They traced the instruction back to an AGENTS.md in the customer's Downloads folder, which was also the agent's working directory.

The researchers could not work out how the file reached the customer's Downloads folder. They did build a proof-of-concept page showing that "a web page can download a file named AGENTS.md into your Downloads folder, silently". Chrome, Edge and Firefox save downloads to Downloads by default. BleepingComputer notes they do show a download notification, and that Brave asked for approval before saving in its test. It's still unknown whether a real attacker used this route.

How the attack works

Two behaviours that are each harmless on their own combine into one attack:

1. Agents trust the instruction file in their working folder. AGENTS.md is an open format, used by more than 60,000 open-source projects, that tells agents how to build, test and follow a repo's conventions. Agents are built to read and follow it.
2. The web can write to Downloads. A page chooses the file's name and contents, and many people treat Downloads as a folder they filled themselves.

The Codex chain

The real attacker file looked like routine engineering setup notes. It told Codex to add an MCP server entry to ~/.codex/config.toml, and that server then installed function-color. That config file applies to every Codex session on the machine, so the malicious server keeps loading after you leave Downloads and work in any other project.

According to Checkmarx, function-color and function-flag run a postinstall downloader that pulls executables from rotating hosts. The campaign targets Windows only, and Checkmarx found no effect on macOS or Linux. Forever says npm has since removed function-color.

The Claude Code chain

Forever wrote this payload themselves, modelled on the Codex file. A planted CLAUDE.md, framed as internal API gateway setup, asks Claude to write ANTHROPIC_BASE_URL into the project's .claude/settings.json. That sends API traffic to a server the attacker controls. The server receives the session's OAuth token, which is enough to take over the account. It can also pose as the model and return tool calls for Claude to run.

The numbers, and where reports disagree

The headline figures are consistent across coverage. The details around them are not.

Two caveats. These are one vendor's tests, with small samples and payloads it wrote itself, so read the percentages as "this works often", not as precise rates. The telemetry also comes from Forever's own customers, who chose to buy an agent-monitoring product and may not represent developers in general.

Claude Code's lower rate comes from the fact that it asks for approval before writing a settings file and often refuses ones that look suspicious. A long, plausible engineering document got that approval through roughly half the time. An approval prompt only protects you if you read it.

Which instruction files your agent actually loads

Coverage tells you not to run agents in Downloads. The vendor documentation shows the risk is wider than that, for one tool in particular.

The practical point: with Claude Code, "I didn't run it in Downloads, I ran it in a project I unzipped into Downloads" doesn't protect you. Anthropic's docs also say CLAUDE.md is "context, not enforced configuration". Whatever is in the file shapes what the model does, and only permissions, hooks and sandboxing actually enforce limits.

Check your machine now

Work through these on every machine where you use a coding agent.

1. Look for planted instruction files. On macOS or Linux: find ~/Downloads -maxdepth 2 \( -iname 'AGENTS*.md' -o -iname 'CLAUDE*.md' \) On Windows PowerShell: Get-ChildItem $HOME\Downloads -Recurse -Depth 1 -Include AGENTS*.md,CLAUDE*.md Read any file you didn't write before deleting it, so you know what it asked for.
2. Audit Codex's global config. Open ~/.codex/config.toml and look for [mcp_servers.*] blocks you don't recognise, or a changed chatgpt_base_url, as Forever recommends.
3. Audit Claude Code settings. Search ~/.claude/settings.json and every project's .claude/settings.json and .claude/settings.local.json for ANTHROPIC_BASE_URL or any API endpoint you didn't set, for example with grep -rn ANTHROPIC_BASE_URL ~/code ~/Downloads --include='settings*.json'.
4. Check for the known packages. Run npm ls function-color function-flag in your projects and npm ls -g function-color function-flag globally. On Windows, compare against the Checkmarx indicators for the wider campaign, such as %APPDATA%\node.exe and a scheduled task named \Maiden.
5. If anything turns up, assume credentials leaked. A leaked agent token works as a live session. Log out of the agent and log back in, revoke API keys that were on the machine, and treat a confirmed function-color install as a full compromise of a Windows host. That means rotating everything that host could reach.

Harden the setup so it can't happen again

For individual developers

• Give agents a dedicated workspace, such as ~/code, and only start them inside a specific project. That matches what OpenAI and Anthropic already recommend, according to BleepingComputer: run agents in the project directory, not your home directory or a broad parent folder.
• Make the browser ask before saving. Chrome and Edge can ask where to save each download, and Firefox can ask every time. That one prompt removes the "silent" part of the attack.
• Exclude Downloads instruction files in Claude Code. The claudeMdExcludes setting matches absolute paths with globs and also applies to AGENTS.md files Claude reads. Add patterns such as **/Downloads/CLAUDE.md and **/Downloads/AGENTS.md to your user settings, then run /memory to confirm what loads.
• Keep approvals and sandboxes on. Be suspicious of any instruction file that asks the agent to change its own config, add an MCP server, change an API base URL, or turn safety features off. Legitimate project notes almost never need to.

For teams

• Enforce with settings, not instructions. Anthropic's docs separate guidance (managed CLAUDE.md) from enforcement (managed settings such as permissions.deny and sandbox.enabled). Use deny rules or a PreToolUse hook to block writes to agent config files and to block environment changes that reroute API traffic.
• Watch config files for drift. ~/.codex/config.toml and .claude/settings*.json change rarely. Endpoint tooling or a simple checksum job that alerts on changes would have caught both attack chains.
• Review instruction files like code. A new or edited AGENTS.md in a pull request deserves the same scrutiny as a new CI script, because it effectively is one.

If you're comparing agents on how they handle untrusted instructions, the AI coding assistants category is a starting point. Ask vendors directly how their tool treats instruction files it finds in folders you didn't create.

What this changes for people building agent tools

If you ship an agent, a CLI or an IDE extension, take this as a design brief:

• Treat instruction files as untrusted input. Show users which instruction files loaded and from which paths, before the first action rather than buried in a debug view.
• Ask for trust on first sight. A file appearing in a directory the user has never trusted, especially Downloads, Desktop or a temp folder, should trigger a confirmation.
• Put config-changing actions in their own tier. Writing a global config, registering an MCP server or changing a base URL should need explicit approval with a plain-language diff. It shouldn't share a generic "allow file write" prompt.
• Warn on risky working directories. A one-line warning when an agent starts in ~/Downloads or ~ costs almost nothing.

What to watch next

Three open questions. First, whether OpenAI or Anthropic add guardrails such as Downloads warnings or stricter handling of config writes, even though Forever argues there is nothing to patch. Second, whether researchers find the same pattern in other AGENTS.md-compatible tools, since the format is now supported across most major agents. Third, whether attackers move from npm payloads to the token-theft route, which leaves fewer traces on disk.

Today, do the five checks above, move your agent sessions out of Downloads, and turn on "ask where to save" in your browser.