A single AGENTS.md in the Downloads folder could hijack coding agents (unverified report)

What happened

According to the author (takuh), on October 22, 2026 the security firm Forever Security published an attack in which a single Markdown file placed in the Downloads folder takes over an AI agent. It was found on a real customer's PC. The trigger was an alert from the firm's monitoring system, which stopped a coding agent on a customer's PC from installing a malicious npm package called function-color. Tracing the cause, the customer's ~/Downloads held an AGENTS.md of about 13KB: a long text posing as "Engineering Work Guidelines", with the attack instructions tucked into a passage near the end. The agent had been launched in that very folder. How the file got into the Downloads folder is unknown. The researcher separately demonstrated that merely opening a web page can place it, but it is unclear whether the real attacker used that method. This article is the author's write-up; the author says they checked the original report, BleepingComputer's coverage (October 25) and the official documentation.

The chaos on the ground

The flow the researcher reproduced is as follows. The user opens a web page, and the page's JavaScript saves AGENTS.md or CLAUDE.md into the Downloads folder. When the user launches the AI there to tidy files or unzip an archive, the AI reads the instruction file as its working rules and, following it, rewrites its own configuration.

With Codex, the attacker's MCP server was registered in ~/.codex/config.toml, which applies to the whole PC. Runs with approvals and the sandbox turned off also took place along the way; per the report, that option was added by the AI itself as "needed for installation", and the success rate was over 90%. Once registered, the attacker's server is loaded no matter which project Codex is launched in.

With Claude Code, the destination was rewritten in .claude/settings.json to the attacker's server. On the next launch the login token was sent to that server, and the researcher reports being able to use the real API as the victim with that token. The attacker's server could also pose as the AI's reply and make it run commands outside the sandbox. However, the write succeeded only about half the time with Claude Code, because such writes need human approval and Claude itself often refused writes that looked unnatural.

The author warns about how to read the numbers. The post that spread on X said "about 50% of developers launch in the Downloads folder", which is not the original report's figure; the original says agents launched in the Downloads folder were found at about half of Forever Security's customer companies. According to BleepingComputer, across its customers more than 1,300 sessions of Claude Code alone were launched in the Downloads folder.

Root cause

According to the author, the attack involves no bug; ordinary, individually harmless behaviors overlap in the Downloads folder and form the hole.

• Browsers save plain text such as .md without a warning. Chrome, Edge and Firefox save to ~/Downloads by default without asking (in BleepingComputer's test, Brave asked before saving). The author also confirmed with Chrome 156, using a page that saves a file when opened, that AGENTS.md was saved without a click (checked in headless mode).
• Codex and Claude Code automatically read instruction files at startup. Since version 2.1.277, Claude Code reads AGENTS.md when there is no CLAUDE.md, so one AGENTS.md reaches both tools. It also reads instruction files in folders above the launch folder, so launching in ~/Downloads/tool-v2/ still loads ~/Downloads/AGENTS.md. The AI cannot tell whether the owner or an attacker wrote the file.
• The Downloads folder is where files received from the web, email and chat, written by other people, collect.
• The trust prompt is asked once per folder. Claude Code records trusted folders in ~/.claude.json and Codex in ~/.codex/config.toml; once trusted, instruction files placed later are read without confirmation. In the author's setup, Codex followed AGENTS.md even in a fake folder with no trust setting.
• Config files decide the endpoints, the external tools in use and what may run without asking. Once they are rewritten, the foundation of the AI belongs to the attacker.

The author contrasts this with an earlier Claude Code bug, CVE-2026-21852, a flaw where communication started before the confirmation screen, fixed in 2.0.65. Here the user's trust, the AI following the instruction file and the config rewrite are all as designed, so fixing one part does not settle it. The text could also appear in legitimate setup guides, which makes it hard for antivirus software to stop.

The author's own checks used a harmless file that only writes a marker, and did not reproduce the attack content. Codex 0.159.2 wrote the marker in its first reply in 2 of 2 runs in a fake Downloads folder. For Claude Code 2.1.296, the AI's reply could not be checked because the login had expired, but /context showed AGENTS.md loaded both in the fake folder and in an extracted subfolder. Chrome strips a leading dot and replaces folder separators with _, so a web page cannot directly place a file like .claude/settings.json. That is why the attack writes into the placeable AGENTS.md a request to rewrite the settings, and has the AI itself do the rewriting.

The fix

According to the author, the researcher wrote that there is nothing for OpenAI or Anthropic to fix, so a patch is not to be expected. The measures the author presents are:

• Do not launch an agent in the Downloads folder or any folder inside it. Create a work folder, move only the needed files, and check with ls -la for unfamiliar instruction files or config folders before launching.
• Avoid launching in broad places such as the home folder, clicking "trust" without looking at the contents, and options that remove approvals and the sandbox, such as --yolo or --dangerously-skip-permissions.
• On approval prompts, read the target and the content. Refuse writes to ~/.codex/config.toml, .claude/settings.json or .mcp.json, items that change endpoints, and installs you did not ask for, unless they tie back to your request. The author cautions that in Claude Code's auto mode a classifier model also consults the contents of CLAUDE.md, per the official documentation, so relying on it is not reassuring.
• Turn on Chrome's setting to ask where to save each file before downloading.
• Pre-creating files with the four names such as AGENTS.md in the Downloads folder is only a supplementary measure. In the author's tests, placing just one left a gap, and a renamed file was still read when the AI was asked to list files.
• If you have already used agents there, inspect the instruction files in the Downloads folder, the Codex and Claude Code settings and the trusted folders, and if anything looks suspicious, restore the settings and log in again. The report stresses that a stolen token is a live session.

The lesson is that people decide whose instructions the AI reads. Keep the place where other people's files pile up separate from the AI's workplace.