Researchers found a booby-trapped instruction file in a customer's Downloads folder that pushed an AI coding helper to install a rogue software package.
A plain text file named AGENTS.md, sitting in a customer's Downloads folder, tricked an AI coding helper into trying to install a malicious software package. Security firm Forever Security found it on a real computer, not only in a test. The package was called function-color. The catch is simple: the helper had been started in the Downloads folder, so it read the file and followed it.
AGENTS.md files hold instructions for AI coding agents, such as which tools to use and how to run tests. Agents load these files automatically from the folder they start in. The files are not programs. But if the instructions are malicious, the agent may run commands, install packages or change settings using the permissions it has.
The researchers say there is nothing for OpenAI or Anthropic to fix. An agent that follows the instructions in its folder is doing what it was built to do.
The researchers could not tell how the file reached that customer's Downloads folder. They say a web page could drop one there on its own. Chrome, Edge and Firefox save downloads to that folder by default without asking, though they show a download notice. In BleepingComputer's test, Brave asked the user to approve the download.
The attack still needs one more step: the person has to start their AI agent in that folder. The researchers say that is common, since people ask agents to tidy the folder or act on a new download. Hundreds of Forever's customers do it, and Claude Code alone launched more than 1,300 sessions from there.
Against OpenAI Codex, a harmless test version that simply opened the calculator app worked 90% of the time. With Claude Code, a similar file redirected the tool's traffic to a server the researchers controlled. That exposed a login token (an OAuth token). The server could then pose as the AI model and send back commands that ran code, in roughly 50% of tests.
The risk falls on people who run AI coding agents such as OpenAI Codex, Claude Code and Cursor CLI, especially from the Downloads folder. Businesses with developers using these tools should pass the warning along.
Anyone who does not use these tools has nothing to do here. People who already start their agent inside one specific project folder are in a much safer position, because a stray download will not be in its path.
The steps are in the alert box above. The core idea is to keep the agent's working area narrow. OpenAI and Anthropic both recommend starting these tools in the root of the project they should work on, not in a broad folder.
Because the behavior is intended, a quick patch is unlikely. The researchers say the responsibility sits with users. Watch for any vendor guidance on how agents treat instruction files from untrusted folders.
Never start an AI coding agent in your Downloads folder. Launch it only inside the project it should work on.
A user says Anthropic's Claude Code put his email in web requests, then scam messages arrived. The link is unproven, but it shows what AI tools can share.
Read more: User says Claude Code sent his email address to websitesA viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youTuring Award winner Richard Sutton says more computing power alone will not make AI truly smart. Big AI companies disagree, which matters for anyone betting on AI.
Read more: AI pioneer says piling on computing power won't make machines smart
