AGENTS.md Poisoning: Why Your Downloads Folder Is a Security Boundary for Coding Agents

Forever Security reported on October 22, 2026 that a malicious AGENTS.md file placed in a customer's ~/Downloads folder instructed a coding agent to install the npm package function-color, and monitoring blocked the install before any code ran. Because coding agents like Codex and Claude Code treat their working directory as a trusted project root, an instruction file dropped into a default download location can be read with the same authority as a legitimate project config, with no vulnerability required. The report recommends pre-flight checks such as confirming the working directory and inspecting unexpected AGENTS.md, CLAUDE.md or .cursorrules files before launching an agent session.

Your coding agent trusts one file by design: the instruction file in its working directory. AGENTS.md for Codex, CLAUDE.md for Claude Code, the same pattern across harnesses. That trust is the feature. It is also an attack surface. On October 22, 2026, Forever Security reported a case where an AGENTS.md file in a customer's ~/Downloads folder instructed a coding agent to install the npm package function-color . Their monitoring blocked the install before code ran. They could not determine how the file arrived. Two properties of everyday computing make this possible without exploiting any vulnerability: AGENTS.md there. Chrome, Edge, and Firefox save downloads to that folder by default with a notification but no location prompt. Brave asked for approval. There is no patch to wait for. An agent that follows the instruction file in its folder is doing exactly what it was built to do. The fix is behavioral, and it fits in thirty seconds per session. Coding agents scan the working directory for context files at startup. The scanning heuristic is simple: CLAUDE.md , .cursorrules , or similar. The agent does not distinguish between a project-specific instruction file and an ambient file that happened to be in the directory when you launched. If you start the agent from ~/Downloads , it will read ~/Downloads/AGENTS.md with the same trust it would give to ~/my-project/AGENTS.md . A malicious instruction file can: The attack requires no exploit. It requires only that a user launches their coding agent from a directory containing a malicious context file. Most coding agents treat the working directory as the project root. They assume: These assumptions break down in ambient directories like ~/Downloads , ~/Desktop , or ~ itself. These are not project roots. They are staging areas, dumping grounds, and default save locations. Files arrive there without user intent. Agent runtimes do not establish trust boundaries between user-intended project roots and ambient system directories. They do not: .git folder or other project markers. The result is that any directory can become a project root, and any file in that directory can become configuration. Run these before you start an agent session. Two of them are one-liners. pwd If the output ends in Downloads , Desktop , or your home directory, move. cd into the actual project folder before launching the agent. find . -maxdepth 1 -type f \ -iname " .md" -o -iname ". rules" \ -print This lists markdown files and dotfiles with "rules" in the name. If you see AGENTS.md , CLAUDE.md , or .cursorrules and you did not put them there, inspect them before proceeding. cat AGENTS.md Look for: If the file contains instructions you did not write, delete it. | Approach | Upside | Downside | Implementation Effort | |---|---|---|---| | Manual pre-flight check | Works immediately, no tooling required | Relies on user discipline, easy to skip | Low copy-paste commands | | Directory allowlist | Prevents agent launch outside approved paths | Requires configuration, breaks ad-hoc workflows | Medium shell wrapper or config file | | Context file verification | Detects unexpected instruction files | False positives in multi-project directories | Medium hash database or signature check | | Runtime sandboxing | Limits damage from malicious instructions | Complex to implement, may break legitimate workflows | High OS-level isolation or container runtime | | Agent-side provenance check | Verifies file origin before reading | Requires agent vendor support, not available today | High requires upstream changes | The manual pre-flight check is the only option available today that works across all agents. The other approaches require either custom tooling or changes to agent runtimes. Agent runtimes could establish trust boundaries without breaking existing workflows: ~/Downloads , ~/Desktop , or ~ , show a warning and ask for confirmation before reading context files. package.json , pyproject.toml , or other project markers. None of these changes would prevent users from working in arbitrary directories. They would only add friction when the directory does not look like a project. Even with pre-flight checks, several failure modes remain: ~/Downloads/my-project , the agent may read ~/Downloads/AGENTS.md before it reads ~/Downloads/my-project/AGENTS.md . The priority order depends on the agent's scanning heuristic. .agentic are easy to miss in a manual scan. The pre-flight check reduces risk. It does not eliminate it. Use this approach if: Avoid this approach if: The pre-flight check is a stopgap. The real fix is for agent runtimes to treat filesystem boundaries as security boundaries. Until that happens, the thirty-second check is the best defense available.