A rogue AGENTS.md in your Downloads folder can hijack Codex and Claude Code. Here's how to lock it down

Coding agents read instruction files like AGENTS.md and CLAUDE.md to learn how a project works. That convenience has an obvious flip side: whoever writes the file gets to give your agent orders.

Researchers at Forever Security found exactly that in the wild. A malicious AGENTS.md sitting in a customer's Downloads folder caused an AI agent to try to install an unauthorized npm package. BleepingComputer reported the findings on October 25.

What the researchers showed

• The original file was discovered on a real customer machine. How it got there wasn't established — but a Downloads folder is exactly where stray files from browsers, email and chat land.
• They reproduced the technique against OpenAI Codex; a harmless demonstration succeeded about 90% of the time in controlled tests.
• They showed a related attack against Claude Code that could expose credentials.

The mechanism is classic indirect prompt injection: the agent treats text in a file it reads as instructions rather than data. Instruction files are especially dangerous because agents are designed to follow them.

Why Downloads is the weak spot

People often launch an agent from their home directory or give it broad folder access "just to be safe." If that scope includes Downloads, every file you've ever downloaded becomes potential agent input — and AGENTS.md is a name an agent will treat as authoritative.

Five things to do today

1. Scope agents to the project directory. Start them from the repo root, and don't grant access to your home folder, Downloads or Desktop.
2. Read unfamiliar instruction files before trusting them. Treat AGENTS.md, CLAUDE.md, .cursorrules and similar files in cloned repos like you'd treat a postinstall script.
3. Keep package installs behind approval. Don't auto-approve npm install, pip install or curl | sh style commands, even in "auto" modes.
4. Keep secrets out of reach. Use per-project, least-privilege tokens; avoid long-lived cloud credentials in environment variables an agent can read.
5. Run risky work in a container or VM. If an agent needs broad permissions, give it a disposable environment rather than your laptop.

The bigger picture

Enterprise tooling is catching up. This week Microsoft described controls for what it calls "agentic insiders" — including discovery that now recognizes 60 local agent types (Claude Code, Codex and GitHub Copilot among them), permissions that shrink per task, and conditional access that can pause an agent or require human approval.

For individual developers, the lesson is simpler: an agent is only as trustworthy as the least trustworthy file it can read.