Forever Security says its product stopped a coding agent on a customer machine from installing function-color, a known malicious npm package. The order came from an AGENTS.md file in the user's ~/Downloads folder, which was also the agent's working directory. Coding agents read that file on startup and follow it.

• Why Downloads matters: many browsers (Chrome, Edge, Firefox by default) save files there without asking where, so a web page can drop a file named AGENTS.md. BleepingComputer checked the researchers' harmless proof-of-concept page and it did save such a file; Brave asked first.
• Lab results (vendor tests): a planted file got OpenAI Codex to run a harmless payload in about 90% of tries. A planted CLAUDE.md sent Claude Code's API traffic to the researchers' server, exposing its OAuth token and returning tool calls that ran code in about half of tries.
• How common: Forever says about half its customers run a coding agent inside Downloads, with more than 1,300 Claude Code sessions started there.

The researchers say there is nothing for OpenAI or Anthropic to patch: the agents do what they were built to do. Both vendors already tell users to start agents in the project they are working on, not in home or download folders.