# A rogue AGENTS.md in your Downloads folder can hijack Codex and Claude Code. Here's how to lock it down

> Researchers found a malicious instruction file that tricked a coding agent into installing an unauthorized npm package — and reproduced it with a 90% success rate. Five settings that close the hole.

Published Oct 26, 2026 by TechMeasured Staff · Security · Canonical: https://techmeasured.com/security/agents-md-prompt-injection-downloads-folder

Coding agents read instruction files like `AGENTS.md` and `CLAUDE.md` to learn how a project works. That convenience has an obvious flip side: **whoever writes the file gets to give your agent orders.**

Researchers at Forever Security found exactly that in the wild. A malicious `AGENTS.md` sitting in a customer's **Downloads** folder caused an AI agent to try to install an unauthorized npm package. BleepingComputer reported the findings on October 25.

## What the researchers showed

- The original file was discovered on a real customer machine. How it got there wasn't established — but a Downloads folder is exactly where stray files from browsers, email and chat land.
- They reproduced the technique against **OpenAI Codex**; a harmless demonstration succeeded **about 90% of the time** in controlled tests.
- They showed a related attack against **Claude Code** that could expose credentials.

The mechanism is classic **indirect prompt injection**: the agent treats text in a file it reads as instructions rather than data. Instruction files are especially dangerous because agents are *designed* to follow them.

## Why Downloads is the weak spot

People often launch an agent from their home directory or give it broad folder access "just to be safe." If that scope includes Downloads, every file you've ever downloaded becomes potential agent input — and `AGENTS.md` is a name an agent will treat as authoritative.

## Five things to do today

1. **Scope agents to the project directory.** Start them from the repo root, and don't grant access to your home folder, Downloads or Desktop.
2. **Read unfamiliar instruction files before trusting them.** Treat `AGENTS.md`, `CLAUDE.md`, `.cursorrules` and similar files in cloned repos like you'd treat a `postinstall` script.
3. **Keep package installs behind approval.** Don't auto-approve `npm install`, `pip install` or `curl | sh` style commands, even in "auto" modes.
4. **Keep secrets out of reach.** Use per-project, least-privilege tokens; avoid long-lived cloud credentials in environment variables an agent can read.
5. **Run risky work in a container or VM.** If an agent needs broad permissions, give it a disposable environment rather than your laptop.

## The bigger picture

Enterprise tooling is catching up. This week Microsoft described controls for what it calls "agentic insiders" — including discovery that now recognizes **60 local agent types** (Claude Code, Codex and GitHub Copilot among them), permissions that shrink per task, and conditional access that can pause an agent or require human approval.

For individual developers, the lesson is simpler: an agent is only as trustworthy as the least trustworthy file it can read.


## Sources

1. [BleepingComputer — AI coding agents hijacked using AGENTS.md file in Downloads folder](https://www.bleepingcomputer.com/news/security/ai-coding-agents-hijacked-using-agentsmd-file-in-downloads-folder/)
2. [Tech Startups — Tech News Today, October 26, 2026](https://techstartups.com/2026/10/26/tech-news-today-october-26-2026-nvidia-metas-95b-ai-funding-plan-spacexs-40b-chip-deal-and-anthropic-security-breach/)
3. [myITforum — Microsoft controls for agentic insiders](https://myitforum.substack.com/p/it-pros-weekly-roundup-october-2630)