Don't Run Your AI Agent in the Downloads Folder
A website can drop a file in your Downloads folder that quietly takes over your coding agent. Here is how it works and the three-minute fix.
AI coding agents like Claude Code and Codex read a plain text file, AGENTS.md or CLAUDE.md, to learn how you want them to work. They treat that file as your instructions. That is handy, and it is also the problem.
The attack in one paragraph
Researchers at Forever Security found a booby-trapped AGENTS.md sitting in a real customer's Downloads folder, dressed up as ordinary engineering notes. Websites can save files into Downloads without asking. If you later start an agent in that folder and give it any task, it reads the planted file and follows it.
What the planted file makes the agent do
- Codex: add a hidden tool server to its global settings that installs a malicious npm package. Because the setting is global, it loads in every future Codex session, not just in Downloads. It worked more than 90% of the time in their tests.
- Claude Code: point the agent's API traffic at the attacker's server. That leaks your login token, and the attacker can answer with commands that run on your machine.
Nothing here is a bug the vendors can simply patch. The agents are doing what they were built to do: follow the instructions file in the folder you trusted.
Why this matters more for agents
Most security tricks assume a person is there to notice something odd and refuse to click. An agent working on its own does not get that gut feeling. Markdown has quietly become something that runs.
The fix
- Never start an agent in Downloads. Keep projects in their own folder, like ~/code or ~/apps.
- Untrust Downloads. In Codex, open ~/.codex/config.toml and delete any [projects] entry that points into Downloads. In Claude Code, do not accept the trust prompt for that folder.
- Read instruction files you did not write. If an AGENTS.md or CLAUDE.md shows up from somewhere else, open it before your agent does.
- Check your settings. Look for unfamiliar [mcp_servers] entries in Codex, or an ANTHROPIC_BASE_URL you did not set in Claude's settings.json.
- Keep approvals and sandboxing on. Be suspicious of anything telling the agent to turn them off.
We ran this checklist on our own machine the morning we read the report. Our setup was clean, but Codex still trusted the Downloads folder from old work. That is gone now. It took three minutes.