What happened
Forever Security, a firm that monitors risks introduced by AI agents, found a malicious AGENTS.md file in a customer's Downloads folder that was also the coding agent's working directory. The agent was attempting to install a rogue npm package called function-color, and the investigation traced the install back to the instruction file.
AGENTS.md and CLAUDE.md are plain text files that tell an agent which tools to use, how to run tests and which conventions to follow. They are not executables, but they direct the agent to run commands, install packages and change settings with whatever permissions it holds. The researchers were blunt: there is nothing here for OpenAI or Anthropic to patch, because an agent that follows the AGENTS.md in its folder is doing exactly what it was built to do.
The delivery path is ordinary. Browsers save downloads to the Downloads folder by default, Chrome, Edge and Firefox do it without asking for a location each time, and a web page can drop a file there silently. The researchers built a proof of concept that did exactly that. The attack then waits for someone to start an agent in that directory, which their telemetry says is common: hundreds of customers run Claude Code, Codex or Cursor CLI from Downloads, and Claude Code alone had launched more than 1,300 sessions there.
Against Codex, using a harmless payload that opened the calculator, the chain worked about 90 percent of the time. In a separate test a malicious CLAUDE.md redirected Claude Code's API traffic to a server the researchers controlled, exposed the agent's OAuth token, and let the server impersonate the model and return tool calls that executed code in roughly 50 percent of tests.
Why this is a GRC story
Configuration is an attack surface with no CVE. No advisory number, no patch, no scanner signature. If this is not in the risk register it has no owner, no treatment and no review date, which is how a known technique stays unfixed for years.
The trust boundary is the working directory. The agent treats files beside it as instructions, and Downloads is the one folder web content writes to on its own. A written standard that agents start at the project root, never in the home or downloads folder, costs nothing and closes the path described here.
Approval is not a control if the human always approves. A 90 percent success rate suggests the prompt appears during a task the user wants finished. Approval fatigue is a design weakness and these numbers are the evidence.
Agent inventory belongs in the endpoint inventory. Which agents are installed, who runs them, from which directories, with which credentials. Few organisations can answer that, and the answer decides how much of this applies.
What to watch
Whether vendors warn when an agent starts in a download folder, and whether browsers start prompting on instruction file names. Both are cheap, and neither replaces a policy decision.
The practical work is small: block Downloads as a working directory on managed machines, add AGENTS.md and CLAUDE.md to file monitoring, confirm approval prompts and sandboxing are on rather than muted, and check whether any build job runs an agent from a download or staging directory.
Attribution: Analysis based on BleepingComputer and related public reporting. This article is original commentary, not a repost of the source material.