AGENTS.md planted in Downloads hijacks coding agents

Forever Security researchers Gal Weizman and Omer Samet published a report on 22 October about a real customer incident. A coding agent tried to install function-color, a known malicious npm package. The cause was an AGENTS.md file in ~/Downloads, which was also the agent's working directory, so the agent treated it as project rules. Forever stopped the attack before any code ran but has not found how the file got there.

In follow-up tests Codex obeyed malicious instructions in more than 90% of cases, including changing its machine-wide MCP configuration. Reports differ for Claude Code: one says it was manipulated in about half of tests; another describes a variant that rerouted its API endpoint and exposed an OAuth token the researchers replayed. npm now serves function-color as a security placeholder.

Agents are built to trust instruction files in their working folder, so there is no single patch for OpenAI or Anthropic to ship. Experts call it an architectural weakness rather than proof of widespread exploitation, but Downloads is where browsers and email drop files without asking.

The attack is simple: no code, no exploit, just a text file left where an agent starts. A zip archive, fake project template or email attachment could carry it.

AGENTS.md tells coding agents how to work in a project; Claude Code uses CLAUDE.md. MCP connects agents to tools. Prompt injection hides instructions in content an AI reads, here a local file.

The same week brought the poisoned LiteLLM release and an Arrakis report finding 76% of enabled agents idle for 60 days yet holding live credentials. Expect agent makers to ask before trusting instruction files outside a project.

• Never run agents in Downloads or your home folder.
• Search for stray AGENTS.md and CLAUDE.md files and delete unknown ones.
• Require approval before package installs.