AI Coding Agent Hijacking via Malicious Instruction Files in Downloads Folder
Researchers at Forever Security have revealed a new attack technique that enables attackers to direct AI coding agents to execute malicious commands and install harmful software packages. This technique relies on exploiting how AI agents read markdown instruction files, such as "AGENTS.md" or "CLAUDE.md," which are silently deposited into the user's main Downloads folder.
Attack Mechanism via Silent Downloads
Instruction files like "AGENTS.md" are a standard way to provide AI agents with project-specific guidelines, such as formatting rules, tools used, and how to run tests. However, most popular web browsers, including Chrome, Edge, and Firefox, allow websites to download files into the default Downloads folder without requiring explicit user consent for each file.
When a developer runs an AI agent inside the Downloads folder—a common behavior for organizing folders or handling newly tested files—the agent automatically reads the malicious file and executes the harmful instructions contained within it, using the permissions and tools available to it in the local system environment.
Practical Tests and Exploitation of Popular Tools
Tests conducted by the researchers proved that the attack could be successfully executed on prominent coding tools such as OpenAI Codex and Claude Code. In one real-world case involving a client, the coding agent attempted to install a malicious package from the npm repository called "function-color" based on instructions from a malicious file that had settled in the folder.
In another experiment, researchers succeeded in redirecting traffic from the Claude Code model to an external server they controlled, which led to the exposure of an OAuth token, the hijacking of the agent account, and the redirection of commands to execute software on the device with a success rate of approximately 50%. Meanwhile, the success rate for exploiting the OpenAI Codex model reached nearly 90%.
Why This News Matters to Developers
The significance of this development lies in the fact that the exploited behavior is not a software vulnerability within AI platforms that requires an update or patch from companies like OpenAI or Anthropic; the agent is simply executing what it was built to do by reading instructions in its working directory. Consequently, the responsibility for prevention and risk mitigation falls entirely on the user and developer to control the agent's scope of permissions and its operating environment.
Recommendations and Prevention Methods
To protect development environments from exploitation, it is recommended to adhere to the following guidelines:
- Avoid setting the main Downloads folder as a working environment or execution path for AI agents.
- Run the coding agent exclusively in the root folder of the specific software project to restrict its access to external files.
- Review and inspect instruction files such as "AGENTS.md" and "CLAUDE.md" from untrusted sources before allowing the agent to process them.
- Enable sandboxing and manual confirmation options before executing commands or installing software packages.