Misbehavior1 sourceFirst seen
Your Downloads Folder Is Now a Hacker's Suggestion Box: AGENTS.md Hijacks Coding Agents
Ourtake
Nothing to patch, say the researchers, which is a very modern way of saying the agent did exactly what it was told.
What happened
Forever Security found a malicious AGENTS.md file in a customer's Downloads folder that tricked a coding agent into attempting to install a malicious npm package. In lab tests, the researchers reproduced the attack against OpenAI Codex with a harmless payload, and showed a CLAUDE.md variant against Claude Code that exposed an OAuth token. The researchers say there is nothing for OpenAI or Anthropic to patch, and advise against running agents from Downloads.