A Downloads folder can become an instruction channel for coding agents

What happened?

Forever Security’s October 22 report describes a customer alert that was stopped before execution, followed by controlled reproductions involving AI coding agents. The central mechanism is an attacker-controlled instruction file such as AGENTS.md placed in a directory where an agent is asked to work. If the agent reads that file as project guidance, the file can influence commands, configuration or tool use. The report describes a Codex path that could affect user-wide configuration and a Claude Code demonstration aimed at settings and token routing; it does not establish that all installations or all agents behave identically.

The report separates observed and demonstrated behavior. A live alert was blocked before the reported payload ran. The Codex reproduction and the Claude Code proof of concept were specially prepared tests, not a field survey of ordinary Downloads folders. Forever Security’s prevalence figures are self-reported under its testing conditions, and the report does not provide a denominator that would let readers convert them into a rate for all developers. The OSV advisory records the associated malicious package versions rather than proving that every editor or agent installation is affected.

The risk comes from the boundary between data and instructions. Developers often download archives, repositories, issue attachments or generated files and then launch an agent from that directory. An agent that automatically trusts local instruction files can inherit attacker-chosen text at the moment it also has access to a shell, credentials or a project. The practical exposure depends on the agent, version, settings, permissions and whether the user reviews commands. OpenAI and Anthropic documentation both describe instruction and settings mechanisms, but neither document alone proves the specific exploit path in every release.

Source: Forever Security ↗ · Source: Open Source Vulnerabilities ↗ · Source: OpenAI ↗ · Source: Anthropic ↗

Why does it matter?

The security lesson is not “Markdown is executable” in the operating-system sense. It is that a natural-language instruction file can become executable in effect when an agent treats it as trusted guidance and has tools that perform side effects. That makes provenance and working-directory choice part of the threat model. A downloaded file can be harmless as text yet dangerous when it changes the policy an agent follows before a human reviews the plan.

The right defense is layered. Developers should avoid launching powerful agents in untrusted directories, inspect repository instruction files before accepting them, run agents with least-privilege accounts and isolated sandboxes, keep credentials out of the working environment and review configuration changes and network actions. Security teams should pin versions, monitor changes to user-wide agent settings and treat packages or coding exercises from unknown sources as untrusted. These steps reduce blast radius even when the exact product behavior changes.

The practical defense is to treat instruction files as code review material even when they are written in Markdown. Before running an agent, inspect the directory tree and the files that can be discovered automatically, then start with read-only permissions if possible. If the task requires network or package installation, make that escalation explicit and review the exact command. This preserves the useful convenience of repository guidance without allowing an unseen file to silently redefine the agent’s authority for safety.

Reporting discipline matters because the evidence is easy to overstate. The customer alert was stopped, the demonstrations were controlled and the report does not disclose a universal affected-version range or successful delivery mechanism. That still makes the finding useful: it identifies a class of prompt-and-configuration injection that can cross from a project folder into an agent’s broader authority. It does not justify saying that every Codex or Claude Code user is compromised, that a malicious file automatically installs malware, or that the vendors have confirmed identical vulnerabilities.

Source: Forever Security ↗ · Source: Open Source Vulnerabilities ↗ · Source: OpenAI ↗ · Source: Anthropic ↗