Clarissa Hana
Researchers have uncovered a sophisticated new method for compromising AI coding agents, exploiting a common user behavior and the inherent design of these powerful tools. A malicious markdown instruction file, disguised as an AGENTS.md file, was discovered in a customer’s Downloads folder, successfully tricking an AI coding agent into installing a rogue npm package. This groundbreaking research, conducted by the cybersecurity firm Forever Security, demonstrates the alarming ease with which these advanced AI assistants can be manipulated to execute arbitrary code, steal sensitive credentials, and potentially hijack user accounts. The implications are significant, as AI coding agents become increasingly integrated into professional workflows, raising urgent questions about security protocols and user education.
The vulnerability hinges on the way AI coding agents, such as OpenAI’s Codex and Anthropic’s Claude Code, process instructions. These agents are designed to interpret plain-text files, typically markdown documents, that contain project-specific guidance. These instructions can dictate everything from the tools the agent should employ and the testing methodologies to be followed, to the adherence to specific coding conventions. The AGENTS.md file, in this context, acts as a set of directives for the AI. When an AGENTS.md file is present in the agent’s working directory, the AI automatically loads and executes the instructions contained within. Crucially, these files are not executables in themselves, but the instructions they contain can prompt the AI to run commands, install software packages, or alter system settings, leveraging the permissions and tools already granted to the agent.
The Discovery and Reproduction of the Attack
The initial discovery of this exploit occurred during a routine security monitoring operation by Forever Security for one of its clients. An AI coding agent on the client’s system was observed attempting to install a suspicious npm package named function-color. Further investigation by Forever Security’s researchers traced this anomalous activity back to an AGENTS.md file located within the client’s ~/Downloads directory. This directory also happened to be the designated working directory for the AI agent in question.
Intrigued by this finding, the researchers at Forever Security embarked on a mission to reproduce the attack. Their work confirmed the exploit’s efficacy against leading AI coding assistants. They successfully demonstrated a technique that could trick OpenAI Codex into executing arbitrary commands. Furthermore, they showcased a related method capable of manipulating Anthropic’s Claude Code. This latter demonstration involved exfiltrating OAuth tokens, a critical security credential, which then allowed the attackers to impersonate the AI model and issue commands that executed code on the victim’s system, effectively hijacking their account.
"There is nothing here for OpenAI or Anthropic to patch," the researchers stated in their report, highlighting that the AI agents are behaving precisely as designed – following the instructions provided in the AGENTS.md file within their designated working folder. This fundamentally shifts the responsibility for security, placing it squarely on the user and the inherent design of browser download behaviors.
The Role of the Downloads Folder
The ~/Downloads folder emerges as a particularly critical point of vulnerability. Forever Security’s research emphasizes that this directory holds a unique position in the user’s file system. Unlike most other folders, the web browser, with its broad access privileges, can write files directly into the Downloads folder without requiring explicit user permission for each download. This means a malicious webpage could silently deposit an AGENTS.md file into a user’s Downloads directory, bypassing typical security checks and user awareness.
To illustrate this, the researchers developed a proof-of-concept (PoC) demonstrating how a malicious file could be dropped into the ~/Downloads location undetected. Their PoC page, when accessed, automatically downloaded an AGENTS.md file. While the tested file contained innocuous content ("sensitive data here" and "line 2"), the mechanism itself is what poses the threat. Many popular web browsers, including Google Chrome, Microsoft Edge, and Mozilla Firefox, are configured by default to save downloaded files directly to the user’s ~/Downloads directory without prompting for a specific save location. This default behavior, while convenient for legitimate downloads, creates an avenue for silent, unauthorized file drops.
While some browsers, like Brave, do prompt the user to approve downloads, thereby offering a layer of notification, the prevalence of browsers that do not, coupled with the common practice of downloading files without close scrutiny, makes this a significant risk. The critical element is that once the malicious AGENTS.md file is in the Downloads folder, the attack is not yet complete.
The Attack Chain and User Interaction
The final stage of the attack requires the user to initiate their AI coding agent within the ~/Downloads folder. This is a surprisingly common practice. Many users leverage AI agents for tasks such as organizing their downloads, processing newly acquired files, or simply working within a familiar and easily accessible location. Internal statistics cited by Forever Security indicate that hundreds of customers routinely run AI agents, including Claude Code and OpenAI Codex, directly from their ~/Downloads folders. For instance, Claude Code alone has been observed launching over 1,300 sessions from this directory.
When the AI agent is activated in a directory containing the malicious AGENTS.md file, it automatically parses the instructions. These instructions, crafted by an attacker, can then command the agent to perform a wide range of actions. The researchers’ reconstructed attack chain against Codex, using a harmless payload that simply opened the calculator application, achieved a remarkable 90% success rate. This indicates the high reliability of this method for initiating code execution.
Credential Theft and Account Hijacking
The implications extend far beyond simply opening applications. In a separate, more insidious test, the researchers employed a maliciously named file, CLAUDE.md, to target Claude Code. This file was designed to redirect the AI’s API traffic to a server controlled by the attackers. By intercepting this traffic, the researchers were able to obtain the agent’s OAuth token. This token, essentially a digital key, allowed the attacker’s server to impersonate the AI model. Consequently, the attackers could inject malicious tool calls that executed arbitrary code on the victim’s system in approximately 50% of their tests. This represents a direct pathway to account hijacking, enabling attackers to gain unauthorized access and control over systems that rely on these AI agents.
Broader Implications and Mitigation Strategies
The security vulnerability identified by Forever Security is not a flaw in the AI models themselves, but rather a consequence of the interplay between standard browser download behaviors and the intended functionality of AI coding agents. As such, there is no simple software patch that OpenAI or Anthropic can implement to fully address this threat. The responsibility for mitigation falls on users and developers to adopt more secure practices.
The core recommendation from both OpenAI and Anthropic is clear: AI coding agents should always be run from the specific project directory they are intended to work on. This principle of limiting the agent’s working scope is paramount. By confining the agent to a relevant project folder, users provide it with appropriate context and simultaneously restrict its ability to access or process untrusted files located in unrelated directories, such as the Downloads folder.
Users are strongly advised to avoid setting their ~/Downloads folder as a default working directory for any AI coding agent. This location is inherently untrusted, as it is the primary destination for files downloaded from the internet. When an AI agent is instructed to operate within this folder, it risks interpreting potentially malicious instructions within downloaded files as legitimate directives.
Furthermore, a layered approach to security is essential. Users should:
- Review Instruction Files: Before allowing an AI coding agent to proceed, users should meticulously review any unfamiliar instruction files, such as
AGENTS.mdorCLAUDE.md. - Enable Approval Prompts: Keep browser settings configured to prompt for download locations or at least provide clear download notifications.
- Utilize Sandbox Protections: Employ sandboxing technologies and virtual machines when dealing with potentially untrusted code or files.
- Test in Isolated Environments: Always test potentially risky code in an isolated environment before executing it on a primary system.
The widespread adoption of AI coding assistants marks a significant advancement in software development and productivity. However, as this research starkly illustrates, it also introduces new attack vectors that require a fundamental rethinking of security practices. The ease with which a malicious instruction file can be delivered and executed, combined with the common user behavior of utilizing AI agents in their Downloads folder, creates a potent recipe for compromise. Addressing this vulnerability necessitates a proactive and educated approach from both users and the developers of these powerful AI tools, ensuring that the benefits of AI do not come at the unacceptable cost of compromised security.
