Security researchers have uncovered a disarmingly simple attack that can seize control of AI coding agents—including OpenAI’s Codex, Anthropic’s Claude Code, and Cursor CLI—without exploiting a single line of application code. All an attacker needs is a malicious instruction file quietly dropped into a developer’s Downloads folder.
The technique, dubbed the AGENTS.md attack by Forever Security, the threat research firm that discovered it, exploits a fundamental design pattern shared by virtually every AI coding tool on the market today: the assumption that any instruction file found in the working directory is trustworthy. The result is an attack vector that requires no software vulnerability, no zero-day, and no social engineering beyond getting a developer to visit a web page.
How the Attack Works
Modern AI coding agents operate by reading one or more “context files” from the directory in which they are launched. These files—often named AGENTS.md, CLAUDE.md, or similar variants—contain project-specific instructions: which packages to use, coding conventions to follow, which APIs to call. The agents treat them as authoritative project documentation and execute their contents without question.
The attack chain begins with a malicious web page. When a developer visits the page, the browser silently downloads a crafted AGENTS.md file to the system’s default Downloads folder—the same destination as any other web download. Chrome, Edge, and Firefox all execute the drop without a prompt. A single page visit is the only interaction required.
The file itself is deceptively structured. It opens with several lines of innocuous-sounding project instructions to reduce suspicion, then embeds its malicious directives deeper in the document. When a developer subsequently opens a terminal session in their Downloads folder—a common habit when inspecting or organizing files—and launches a coding agent, the agent ingests the malicious file as project context and begins following its commands.
In controlled testing by Forever Security, the technique achieved a success rate of over 90% for arbitrary code execution against OpenAI’s Codex agent, causing the agent to silently install a rogue npm package that established a persistent backdoor. A separate variant targeting Anthropic’s Claude Code achieved approximately 50% success in stealing OAuth tokens, which could grant an attacker access to the victim’s connected repositories, cloud environments, and third-party services.
Particularly alarming is Forever Security’s telemetry data: the firm observed more than 1,300 Claude Code sessions launched from the ~/Downloads directory in the wild—meaning real developers are routinely running AI agents from precisely the folder that any website can write to without asking permission.
Why Coding Agents Are Uniquely Exposed
The attack lands at the intersection of two trends that have made AI coding agents so powerful and so dangerous simultaneously: their expanding capabilities and their wholesale trust in local context.
Over the past eighteen months, tools like Codex, Claude Code, and Cursor have evolved from code completion helpers into autonomous agents capable of running terminal commands, installing packages, modifying files, making API calls, and browsing the web—all without step-by-step human approval. That autonomy is precisely what makes them productivity multipliers. It is also what makes a successfully hijacked agent so dangerous.
“The agents are behaving exactly as designed,” the Aviatrix threat research team wrote in an analysis published today. “The problem isn’t a bug. It’s that the trust boundary assumed by the design—that the working directory is a controlled project environment—no longer holds once the Downloads folder is in scope.”
Unlike traditional phishing or supply-chain attacks, the AGENTS.md technique requires no malicious package to be published to a public registry, no compromise of a build pipeline, and no insider access. The attack surface is the filesystem itself, and the filesystem has always been writable by browsers.
No Patch Available
Neither OpenAI nor Anthropic has issued a patch, and as of publication, no fix is available from any of the affected vendors. That is not a failing of their security teams so much as a reflection of the problem’s structural nature: fixing it requires either restricting where agents can read context files from (which would break legitimate workflows), prompting users before ingesting instruction files from certain locations (which degrades the seamless experience users expect), or implementing cryptographic signing for trusted instruction files (a longer-term, ecosystem-wide undertaking).
Cursor and OpenAI declined to comment. Anthropic said it was aware of the research and is evaluating mitigations.
What Developers Can Do Now
In the absence of vendor patches, security researchers recommend a combination of procedural and technical controls.
The most immediate step is a change in habit: never launch an AI coding agent from the Downloads folder, and scope each agent session to a specific, controlled project directory. Developers who use automated download managers should configure them to route files to a dedicated folder that sits well outside any project root.
At the infrastructure level, organizations should consider egress filtering for agent processes—restricting outbound connections to known model provider endpoints so a hijacked agent cannot phone home to an attacker-controlled server. Similarly, scoping API tokens and OAuth credentials so that a stolen credential cannot access repositories or services beyond the intended scope limits the blast radius of a successful attack.
For teams using Claude Code or Codex in CI/CD pipelines, auditing which directories the agent is permitted to read and restricting that scope to verified project roots provides a meaningful defense. Some security vendors are already shipping agent-aware firewall rules capable of detecting anomalous package installation requests or unexpected API traffic patterns.
A Glimpse of the New Attack Surface
The AGENTS.md attack is a preview of a category of threats that security professionals have been warning about for the past year: attacks that don’t exploit software vulnerabilities but instead exploit the intentions of AI systems. Rather than finding a bug in Codex or Claude Code, the attacker simply tells the agent what to do and relies on the agent’s own capabilities to carry out the objective.
As coding agents gain wider adoption—industry estimates suggest more than 60% of professional developers now use some form of AI coding assistance daily—the attack surface they represent will grow proportionally. Every agent session launched from an untrusted directory is a potential entry point.
The lesson from AGENTS.md is a familiar one from a previous era of security: what looks like a document is, from the software’s point of view, a script. Developers learned to be cautious about running macros embedded in Word files. The lesson for the AI agent era is the same, updated for a world in which the “macro” is expressed in plain English and the “document” is a Markdown file sitting in your Downloads folder.
For now, the best defense is awareness—and the discipline to keep AI agents confined to the directories they were meant to work in.
KickHammer News covers emerging technology with a focus on AI, security, and the systems shaping tomorrow’s digital landscape.
