The Downloads Folder Just Became a Prompt Injection Vector for AI Coding Agents

A Markdown File, a Downloads Folder, and a 90% Success Rate

Researchers at Forever Security discovered a malicious AGENTS.md file sitting in a customer's Downloads folder. That file tricked an AI coding agent into attempting to install the npm package function-color—a package with no legitimate purpose except to serve as a payload. The file wasn't exotic. It wasn't encrypted. It was a plain markdown instruction sheet, the same format coding agents trust for project context, silently deposited by a browser download and then picked up as authoritative guidance the moment the developer launched their agent in that directory.

The attack chain was straightforward enough to make you wonder why nobody had tried it sooner.

The Attack Chain, Step by Step

Here's how the researchers reconstructed the sequence:

1. A victim installs a malicious npm package.
2. That package opens a webpage in the background.
3. The webpage triggers a browser download of AGENTS.md into ~/Downloads. No user interaction required. Chrome, Edge, and Firefox save downloads to that folder by default—no per-file location prompt.
4. The developer launches their AI coding agent from ~/Downloads, perhaps to organize the folder or work on a freshly downloaded file.
5. The agent reads AGENTS.md from its working directory and follows the embedded instructions.

BleepingComputer verified the proof-of-concept page and confirmed that visiting it silently downloaded an AGENTS.md file containing harmless test strings ("sensitive data here" and "line 2"). The browser notification appeared, Chrome, Edge, and Firefox all show one by default, but notifications are easy to ignore when you've downloaded a dozen files that afternoon. Brave was the one browser in their testing that prompted for approval before saving, which would have at least interrupted the flow.

Forever Security researcher Gal Weizman told BleepingComputer that launching an agent from ~/Downloads isn't some fringe behavior. It's common practice. People use AI agents to organize that folder, rename files, or act on something they just grabbed from the internet. Internal statistics from Forever show hundreds of customers running Claude Code, OpenAI Codex, and Cursor CLI from ~/Downloads. Claude Code alone logged more than 1,300 sessions from that single directory.

The attack doesn't need a zero-day. It doesn't need privilege escalation. It needs a folder people already use and an agent already configured to trust.

What the Tests Actually Showed

The researchers ran their reconstructed chain against two targets, and the results were ugly.

Against Codex, they used a harmless payload, just opening the calculator app, and recorded a 90% success rate. The agent read the instructions in AGENTS.md and executed them without hesitation.

Against Claude Code, the attack was more layered. They placed a malicious CLAUDE.md file that redirected Claude Code's API traffic to an attacker-controlled server. That server intercepted the agent's OAuth token, then impersonated the model itself, returning crafted tool-call responses that instructed Claude Code to execute arbitrary code. Roughly 50% of those tests resulted in code execution on the victim's machine.

That second test deserves a pause. It's not just that the agent followed bad instructions. It's that the OAuth token exposure turned the agent's own trust relationship into the attack vector. The agent authenticated, the token leaked, and the attacker became the model in the agent's eyes. From there, the agent happily executed whatever "tool calls" came back.

The Boundary That Matters

The researchers are careful to distinguish proof-of-concept from a live campaign. The customer incident triggered the detection; the Codex and Claude Code demonstrations were reconstructed tests with controlled payloads. BleepingComputer's own verification confirmed the browser-download mechanism exists but used harmless content.

That doesn't soften the finding. The boundary is simple: a downloaded instruction file becomes dangerous the moment an agent operates in that folder. The AGENTS.md format was designed for project-level context, trusted input from a repository. Nobody designed it to survive contact with ~/Downloads.

This is the same trust-boundary problem we covered in our analysis of agentic AI identity governance: agents inherit permissions and trust from their environment without a clear mechanism to distinguish "this instruction came from my repo" versus "this instruction came from a webpage that ran in my browser." The identity model breaks down when the agent's working directory is also the browser's drop zone.

What This Means for Teams Running Coding Agents

You don't need to rip out Claude Code or Codex. But a few adjustments close the gap that this attack chain exploits:

• Don't launch agents from Downloads. Use a dedicated working directory. If your workflow requires acting on downloaded files, move them first.
• Audit which directories your agents run from. Weizman's stat, 1,300+ Claude Code sessions from one Downloads folder, suggests most teams haven't even looked at this metric.
• Treat instruction files in unexpected locations as untrusted input. An AGENTS.md or CLAUDE.md in ~/Downloads should never carry the same trust level as one committed to a repo you control.
• Monitor outbound OAuth traffic from agent processes. The Claude Code test succeeded because the token was exfiltrated through the agent's own API calls. An agent talking to an unknown endpoint is a red flag regardless of the instruction file's origin.

The 90% success rate against Codex with a calculator payload tells you what a 90% success rate against a real payload looks like. The attack doesn't require sophistication, it requires an agent that trusts its directory and a browser that saves silently.

Both of those are defaults today.