A disturbing vulnerability has been identified in the interaction between web browsers and AI coding agents, allowing attackers to hijack these agents through seemingly innocuous markdown instruction files. Discovered by researchers at **Forever Security**, the method exploits the common practice of AI agents loading configuration from their working directories, coupled with browsers' default download behaviors. ### The Attack Vector: Malicious AGENTS.md Files The core of the attack revolves around specially crafted markdown files, such as `AGENTS.md` or `CLAUDE.md`, which contain project-specific instructions for AI coding agents. These files dictate actions like tool usage, test execution, and coding conventions. Researchers found that if a malicious version of such a file is present in an agent's working directory, the agent will dutifully follow its instructions. **Forever Security** initially observed this tactic on a customer's machine, where an AI coding agent attempted to install a malicious npm package named 'function-color'. The trail led back to an `AGENTS.md` file located in the customer's `~/Downloads` folder, which was also the agent's active working directory. ### Browser Defaults Facilitate Initial Compromise The most concerning aspect of this attack is how the malicious instruction file lands on a user's system. According to **Forever Security**, a webpage can silently download an `AGENTS.md` file directly into the `~/Downloads` folder without any user interaction. This is due to default settings in popular browsers like **Chrome**, **Edge**, and **Firefox**, which save downloaded files directly to this directory without prompting for a save location. While browsers typically display a notification upon download, this might not be sufficient to alert users to the potential threat, especially if the file name appears benign. Researchers demonstrated a proof-of-concept (PoC) showing how such a file could be dropped silently. ### AI Agent Behavior: Doing Exactly What It's Built To Do Once the malicious file is in the `~/Downloads` folder, the attack requires the user to launch their AI agent within that same directory. This is a common scenario, as users often employ AI agents to organize downloads or act on newly acquired files. **Gal Weizman**, a researcher at **Forever Security**, noted that internal statistics show hundreds of customers, including users of **Claude Code**, **OpenAI Codex**, and **Cursor CLI**, frequently run AI agents from their `~/Downloads` folders. **Claude Code** alone recorded over 1,300 sessions from this location. "There is nothing here for **OpenAI** or **Anthropic** to patch. An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do," the researchers stated. ### Demonstrated Impact: Code Execution and Credential Theft **Forever Security** successfully reproduced the attack against **OpenAI Codex**, achieving a 90% success rate in executing a harmless payload (opening the calculator app). A separate test against **Claude Code** using a malicious `CLAUDE.md` file demonstrated the redirection of API traffic to a controlled server, exposing the agent's OAuth token. This allowed the server to impersonate the model and execute code in approximately 50% of tests. ### User Responsibility and Mitigation Strategies The researchers emphasize that this risk stems from a combination of intended browser and agent behaviors, placing the burden of precaution squarely on the user. To mitigate this threat, IT security professionals and privacy-conscious users should adopt the following practices: * **Avoid using `~/Downloads` as an AI agent's working directory**: This folder is inherently untrusted due to its direct exposure to web downloads. * **Scope AI agent working directories**: Follow recommendations from **OpenAI** and **Anthropic** to run AI coding agents from the root of the specific project they are intended to work on. This limits the agent's access to relevant files and reduces the risk of processing untrusted instructions. * **Review instruction files**: Always scrutinize unfamiliar `AGENTS.md`, `CLAUDE.md`, or similar instruction files before allowing an AI coding agent to follow them. * **Enable approval prompts and sandbox protections**: Keep security features that prompt user approval for downloads and isolate potentially untrusted code in sandbox environments. * **Test in isolated environments**: Before running any potentially untrusted code or allowing an AI agent to interact with new instructions, test them in an isolated environment separate from your main system. By adhering to these guidelines, users can significantly reduce their exposure to this novel and potent hijacking technique targeting AI coding agents.