How a folder convention became an attack surface
AI coding agents like OpenAI Codex and Claude Code support project level instruction files, AGENTS.md and CLAUDE.md respectively, that tell the agent how to behave within a given codebase: which commands are safe to run, which conventions to follow, which directories to avoid. That is a genuinely useful feature for real projects, and it is exactly the mechanism researchers at Forever Security found being abused after discovering a planted file on a customer's computer.
The attack works because agents read these instruction files from whichever directory they are launched in, and developers frequently launch a quick agent session directly from Downloads, since that is where a file they just want to inspect, convert, or run has landed. If an attacker can get any file into that folder, through a drive by download, an email attachment, or a bundled installer, they can plant an AGENTS.md alongside it and wait.
What the reproduced attack actually did
In the OpenAI Codex reproduction, launching the agent from a Downloads folder containing the planted AGENTS.md caused Codex to follow instructions embedded in that file, which directed it to install a rogue npm package. The agent had no way to distinguish an instruction file placed by an attacker from one placed by a legitimate project maintainer, because the entire design assumes any instruction file present is trustworthy by default.
A related variant targeting Claude Code used a malicious CLAUDE.md file to redirect the agent's API traffic, a more dangerous outcome because it exposed the agent's OAuth token to an endpoint the attacker controlled. An exposed OAuth token can potentially be reused to impersonate the developer's agent session elsewhere, extending the blast radius well past whatever happens inside that one Downloads folder.
Why this is a behavior problem more than a code problem
Cursor CLI is another agent commonly run from a Downloads folder, according to the researchers, though the article does not confirm it was directly tested against this specific technique. The underlying risk is not unique to any one vendor's agent, it is a consequence of a shared convention: coding agents trust instruction files in their working directory, and Downloads is a working directory millions of developers use casually and constantly.
That makes this closer to the decades old problem of auto running macros in downloaded documents than to a traditional software vulnerability. There is no patch that eliminates the risk entirely while preserving the convenience of project level instruction files, because the feature's usefulness and its exploitability come from the exact same design choice.
What vendors can still do
Agent vendors have real options even without abandoning instruction files altogether. Flagging instruction files found in common download and temp directories as higher risk than ones found in an established git repository would catch a large share of these attempts. Requiring explicit user confirmation the first time an agent reads a new AGENTS.md or CLAUDE.md file, rather than loading it silently, would close much of the gap at a small convenience cost.
Sandboxing and approval prompts already exist in most of these tools and would have blocked or at least surfaced both reproduced attacks here, which suggests the gap is more about default configuration and user habit than about a missing safety feature. Vendors that tighten defaults around directory trust will likely move faster than any effort to retrain developer habits around where they launch agent sessions.
The broader AI agent trust problem this fits into
This technique sits alongside a wider pattern of 2026 security research showing that AI agents inherit trust assumptions built for a world without autonomous execution. An instruction file, a webhook, or a piece of retrieved content that would be harmless to a human reading it passively becomes an attack vector the moment an agent is empowered to act on it automatically and without a human reviewing each step.
Enterprise security teams rolling out coding agents at scale should expect more variations on this theme, not fewer, as agents gain more autonomy and more integration points. The specific fix here, Downloads folder hygiene, addresses this exact technique, but the general lesson, treat any content an agent can read as potentially adversarial, is the one that will keep mattering as agents take on more responsibility.
