Safa Marwah
The proliferation of autonomous AI agents in software development introduces novel security vulnerabilities, with recent findings revealing a critical pathway for system compromise: the manipulation of AI coding agents through seemingly innocuous instruction files strategically placed in common user directories. This emergent threat vector bypasses traditional security measures by exploiting the agents’ fundamental design to follow directives, transforming trusted AI assistants into unwitting instruments of attack.
The core of this sophisticated exploitation hinges on malicious markdown instruction files, such as AGENTS.md, which, when inadvertently located within an AI agent’s operational scope—particularly the user’s Downloads folder—can coerce the agent into executing harmful commands. Cybersecurity researchers have meticulously documented instances where such files successfully tricked AI coding agents into installing rogue software packages, siphoning sensitive credentials, and even facilitating full account hijacking. This vulnerability underscores a shift in the cybersecurity landscape, where the focus expands beyond direct software exploits to encompass the behavioral manipulation of intelligent systems.
AI coding agents are designed to streamline development workflows by automating tasks ranging from code generation and debugging to testing and deployment. They operate by interpreting project-specific instructions, often codified in plain-text markdown files. These files dictate various operational parameters, including the specific tools an agent should utilize, the methodologies for running tests, and the coding conventions to adhere to. The reliance of these agents on external instruction sets, while foundational to their utility, concurrently presents an exploitable interface for adversaries.
A detailed investigation by a prominent cybersecurity firm specializing in AI agent risk assessment brought this vulnerability to light. During routine monitoring of customer systems, an anomaly was detected: an AI coding agent attempting to install a suspicious npm package identified as function-color. Tracing the origin of this unauthorized action led analysts to a meticulously crafted AGENTS.md file residing within the user’s ~/Downloads directory. This directory, crucially, was also configured as the AI agent’s active working directory, making it susceptible to any instructions found within.
The operational paradigm of these agents dictates that they automatically ingest and process relevant files from their designated working directories. This inherent functionality, intended to provide context and guidance, becomes a critical weakness when malicious instructions are introduced. Unlike executable files that directly trigger system processes, these markdown files contain directives that compel AI agents to utilize their existing tools and permissions to perform actions, such as installing packages, modifying configurations, or executing arbitrary code. The insidious nature of this attack lies in its exploitation of the agent’s intended behavior; as researchers observed, "An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do." This highlights that the vulnerability is not a flaw in the AI model’s intrinsic security but rather a systemic risk arising from its operational environment and interaction with user-controlled files.
To validate the severity of this threat, the research team successfully replicated the attack against leading AI coding platforms, including OpenAI Codex and Claude Code. The experiments demonstrated that a specially crafted instruction file could manipulate these agents into executing arbitrary code or extracting sensitive credentials. For instance, a proof-of-concept (PoC) attack against Claude Code involved using a malicious CLAUDE.md file to reroute the agent’s API traffic to an attacker-controlled server. This maneuver exposed the agent’s OAuth token, enabling the server to impersonate the model and issue tool calls that resulted in code execution in approximately 50% of the test cases. Against OpenAI Codex, a similar attack achieved a 90% success rate in compelling the agent to launch a calculator application, a harmless demonstration that nevertheless proved the feasibility of arbitrary code execution.
A pivotal aspect of this attack chain is the silent delivery of the malicious instruction file to the target system. While the precise method by which the initial AGENTS.md file landed in the ~/Downloads folder in the observed incident remains undetermined, researchers elucidated a common mechanism: simply visiting a malicious webpage can trigger an unprompted file download. This capability is deeply rooted in how modern web browsers interact with user file systems. The ~/Downloads directory holds a unique position as the default location where many popular browsers—including Chrome, Edge, and Firefox—save files downloaded from the internet, often without explicit user confirmation for each download. This default behavior, while convenient, creates an avenue for silent payload delivery.
To illustrate this, researchers developed a PoC webpage that could silently drop an AGENTS.md file into the ~/Downloads directory. When tested, this page successfully downloaded a file containing predefined, harmless content, demonstrating the technical viability of the silent delivery mechanism. While some browsers, such as Brave, incorporate stricter default settings that prompt users before saving files, the prevailing practice across the most widely used browsers allows for these surreptitious downloads. Although these browsers typically display notifications upon file completion, the sheer volume of web activity and the commonality of downloads mean that a user might easily overlook or dismiss such an alert, especially if the file name appears innocuous.
Once the malicious file is in place, the second critical step involves the user initiating their AI agent within that compromised directory. While seemingly a specific scenario, internal statistics from the cybersecurity firm reveal that this practice is remarkably common. Hundreds of customers, utilizing agents like Claude Code, OpenAI Codex, and Cursor CLI, frequently operate them from their ~/Downloads folders. This behavior is often driven by convenience, as users might deploy agents to organize newly downloaded content or to act directly upon a recently acquired file. For example, Claude Code alone recorded over 1,300 sessions launched from this particular directory, underscoring the widespread nature of this risky operational pattern.
The cumulative risk, therefore, emerges from the confluence of intended browser functionality (silent downloads to a default location) and the AI agent’s intended behavior (following instructions within its working directory). This complex interaction shifts the primary burden of precaution and defense directly onto the end-user. The implications extend beyond mere convenience, presenting a significant threat to data integrity, system security, and intellectual property. An AI agent, operating with the user’s permissions, could be coerced into exfiltrating sensitive project files, installing backdoors, or disrupting critical development pipelines. This represents a new frontier for supply chain attacks, where the "supply chain" includes not just code dependencies but also the very instructions guiding autonomous development tools.
Mitigating this sophisticated threat requires a multi-layered approach, emphasizing both user vigilance and platform-level best practices. Foremost, users are strongly advised against configuring their ~/Downloads folder as an AI coding agent’s working directory. This directory is inherently untrusted, a common repository for files from unknown or unverified sources, making it a high-risk environment for an autonomous agent designed to execute instructions. Industry leaders like OpenAI and Anthropic consistently recommend that AI coding agents be launched from the root of the specific project directory they are intended to work on. This practice limits the agent’s operational scope, providing it with the necessary context while simultaneously restricting its access to unrelated and potentially malicious files.
The principle of "least privilege" is paramount in the deployment and operation of AI agents. By confining an agent’s working area to the narrowest practical scope and expanding access only when absolutely necessary, the potential for collateral damage from a compromised instruction file is significantly reduced. The working directory effectively defines the agent’s default project context and, depending on the tool, helps establish its filesystem access boundaries. Users should also cultivate a habit of meticulously reviewing any unfamiliar AGENTS.md, CLAUDE.md, or similar instruction files before allowing an AI agent to process them. Enabling and heeding approval prompts for downloads and agent actions, alongside utilizing sandbox environments for testing potentially untrusted code, are crucial protective measures.
Looking ahead, the evolution of AI agents will necessitate a parallel evolution in cybersecurity defenses. AI platform developers may need to explore enhanced default sandboxing for agents, clearer warnings about working directory scope, and perhaps even AI-driven heuristics to identify potentially malicious instruction patterns. Browser developers could also consider more prominent download notifications or a default "prompt-before-save" setting for certain file types, particularly those known to be interpreted by AI agents. Ultimately, the responsibility is shared: users must adopt secure operational habits, developers must design agents with security-first principles, and the broader cybersecurity community must continuously monitor and adapt to these emerging threat vectors. The hijacking of AI coding agents via instruction files in the Downloads folder serves as a potent reminder that as AI systems become more autonomous and integrated into our digital lives, the attack surfaces will expand in unforeseen and intricate ways, demanding perpetual vigilance and proactive defense strategies.
Aura Kasih
Ayu Aulia
Lisa Mariana