---
title: Tip: never start a coding agent in ~/Downloads, or in any folder the web or other people can write to | ctxsec
url: https://ctxsec.com/items/tip-never-start-coding-agent-in-downloads
description: ""
status: "tip based on Forever Security research (Oct 22) and OpenAI/Anthropic guidance cited by BleepingComputer"
published: 2026-10-25
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-never-start-coding-agent-in-downloads.md)

tip based on Forever Security research (Oct 22) and OpenAI/Anthropic guidance cited by BleepingComputer

2026-10-25

### Tip: never start a coding agent in ~/Downloads, or in any folder the web or other people can write to

- Start Codex, Claude Code, Cursor CLI and similar tools in the root of the one project they should work on. Move a downloaded file into a scratch project first if you want the agent to look at it.
- Before an agent works in an unfamiliar folder, look for `AGENTS.md`, `CLAUDE.md` and other instruction or settings files, and read them.
- Set your browser to ask where to save each download, or send downloads to a folder agents never open.
- Keep approval prompts and sandboxing on, and watch for an agent trying to change its own config, API base URL or package sources.

Sources: [Forever Security: Markdown Is the New Executable (Gal Weizman, Omer Samet; Oct 22)](https://forever.security/blog/hijacking-ai-agents-via-downloads-folder) · [BleepingComputer: AI coding agents hijacked using AGENTS.md file in Downloads folder (Oct 25)](https://www.bleepingcomputer.com/news/security/ai-coding-agents-hijacked-using-agentsmd-file-in-downloads-folder/)