A coding agent reads the instruction files in its working directory and does what they say. That is the feature: AGENTS.md and CLAUDE.md exist so a repository can tell an agent which test command to run and which conventions to follow. On 25 October 2026, BleepingComputer reported that researchers at Forever Security found one of those files on a customer's machine in a place nobody put it on purpose: the Downloads folder. The agent read it and followed it.
No exploit, no vulnerability, no model jailbreak. A file in a folder, and a folder someone chose as a working directory.
TL;DR
- Forever Security found a malicious AGENTS.md in a customer's ~/Downloads, which was also the agent's working directory. It told the agent to install a malicious npm package.
- The researchers rebuilt the chain against OpenAI Codex with a harmless payload and report roughly 90 percent success.
- A related technique with a malicious CLAUDE.md redirected Claude Code's API traffic to a researcher-controlled server, exposing the agent's OAuth token and returning attacker-chosen tool calls that executed code in about 50 percent of tests.
- Hundreds of that firm's customers start agents in Downloads. Claude Code alone accounted for more than 1,300 sessions launched from that folder.
- There is nothing to patch. The fix is the working directory, and the scope of the credentials the agent carries into it.
#What the researchers found
The observed file instructed the agent to install an npm package named function-color. The researchers could not establish how it reached the customer's Downloads folder, and they are careful about that gap. What they did show is that a web page can trigger such a download without the user acting on it. Chrome, Edge and Firefox save to Downloads by default, although they show a download notification. BleepingComputer found that Brave asks for approval.
The second condition is the one people supply themselves: somebody has to start an agent in that folder. The researchers say this is ordinary practice, because Downloads is exactly where you ask an agent to sort files, rename things, or look at something you just fetched. Their telemetry supports it: hundreds of their customers do it, and Claude Code alone was launched more than 1,300 times from that location.
#Why there is nothing to patch
This is the uncomfortable part, and why the story is worth ten minutes rather than a headline. As the write-ups put it, the instruction file is not an executable. It is text. The agent reads it, decides, and then acts with the permissions it already has. Nothing was bypassed. Both ends of the chain are intended behaviour: the browser writes to Downloads, the agent reads its folder.
The vendors have little to fix. OpenAI and Anthropic both recommend starting an agent in the specific project directory rather than a home folder or a broad parent. That advice is correct and it is also the entire control. The control is a habit, and habits are not enforced by software.
# as reported by Forever Security via BleepingComputer downloads folder # a file arrives, possibly without the user acting → AGENTS.md # read automatically as instructions for the session → agent session # the agent acts with the permissions it already holds → oauth token # CLAUDE.md variant redirects API traffic, token exposed → code execution # attacker-chosen tool calls returned to the agent
#The part that is an identity problem
A bad npm package is the version of this story that fits in a tweet. The Claude Code variant is the one that should worry a security team.
There, the planted file was used to redirect the agent's API traffic to a server the researchers controlled. Two things follow from that position. The first is the agent's OAuth token, now in someone else's hands, usable against the account. The second is worse in kind: whoever sits between the agent and the model gets to write the model's replies. They return tool calls, and the agent runs them. In the tests, that produced code execution about half the time.
Read that as an identity question rather than a prompt question. The agent is a non-human identity holding a token, running with your permissions, taking orders from whatever text it finds and whatever endpoint it talks to. Neither input is authenticated. The file has no author you verified. The endpoint is whatever configuration says it is.
#Trust is granted once, files arrive daily
There is a control in the products, and it is easy to overrate. Anthropic's Claude Code security documentation describes a workspace trust dialog shown when you start in a folder you have not trusted, a working directory boundary that prompts before file tools reach outside the starting folder in Manual mode, and sandboxing for Bash commands. The same page notes that trust acceptance is saved per directory, and that a session started directly in the home directory holds trust only for that session.
Per directory is the operative phrase. A folder you trusted last month does not ask again when a new file lands in it this morning. Downloads is the one folder whose contents change constantly and arrive from outside. Trusting it once is a standing decision about every file that will ever land there.
| Assumption | What the finding shows |
|---|---|
| Instruction files come from the repository | They come from the working directory, whatever happens to be in it |
| A prompt injection needs content the agent fetches | A file sitting on disk is read first and without a fetch |
| Trusting a folder is a one-time judgement | It is a judgement about every future file in that folder |
| The worst case is a bad dependency | The worst case is the agent's token and its model endpoint |
#What to check this week
- Find out where your developers actually start agents. Not the policy, the shell history. If Downloads, the home directory or a broad parent shows up, that is the finding, and it is fixable the same afternoon.
- Search for instruction files outside repositories. An AGENTS.md or CLAUDE.md in ~/Downloads, ~/Desktop or a home directory has no business being there. Treat one you did not write as an incident, not as clutter.
- Review which folders are already trusted. Trust is per directory and it persists. Revoke anything broad, and keep the list to project roots.
- Check whether the agent's model endpoint can be changed from the working directory. That is the step that turned a nuisance into a token theft. Pin the endpoint in managed settings where your tooling supports it.
- Scope the token, not just the folder. Ask what the agent's credential reaches when someone else holds it: which repositories, which registries, which cloud role is attached to the machine it runs on.
- Keep approval prompts and sandboxing on. They are the difference between a planted file that gets read and a planted file that gets executed. Turning them off to reduce friction is the control you are relying on here.
On Elmoz
#FAQ
What is the AGENTS.md attack?
Coding agents automatically read instruction files such as AGENTS.md or CLAUDE.md from their working directory and act on what those files say. Forever Security found a malicious AGENTS.md in a customer’s Downloads folder that told the agent to install a malicious npm package. BleepingComputer reported the finding on 25 October 2026.
Which agents are affected?
The researchers rebuilt the chain against OpenAI Codex with a harmless payload and report roughly 90 percent success. A related technique using a malicious CLAUDE.md was demonstrated against Claude Code. The behaviour is not specific to one product: any agent that loads instruction files from its working directory is in scope.
Is there a patch?
The researchers argue there is nothing for the vendors to patch, because the agent is doing what it is designed to do: read the instruction files in its folder. OpenAI and Anthropic recommend starting an agent in the specific project directory rather than in a home or a broad parent directory.
Why does a stolen agent OAuth token matter?
In the Claude Code demonstration the agent’s API traffic was redirected to a server the researchers controlled, which exposed the agent’s OAuth token. That position lets an attacker impersonate the model and return tool calls of their choosing, which executed code in roughly half of the tests, and the token itself could be used against the account.
An agent is a machine identity whose instructions arrive from the filesystem. Elmoz inventories those identities, the tokens they carry and the systems each one reaches, so the answer to step five is a list rather than a shrug.