Malicious AGENTS.md file in a Downloads folder tricks an AI coding agent into installing a rogue npm package

Researchers at Forever Security, a company that monitors risks introduced by AI agents, found a malicious AGENTS.md instruction file in a customer's ~/Downloads folder. That folder was also the working directory for the customer's AI coding agent, and the file led the agent to try installing a malicious npm package called 'function-color'. Markdown files like AGENTS.md are plain-text instructions that tell coding agents which tools to use, how to run tests and which conventions to follow. Agents load applicable files from their working directory automatically. The files are not executables, but instructions inside them can still lead an agent to run commands, install packages or change settings. According to BleepingComputer, the researchers reproduced the attack against OpenAI Codex. They also demonstrated a related technique against Claude Code that used only malicious instructions to leak OAuth tokens and take over the account. The Hacker News also reported the incident. The finding affects any developer who runs coding agents in a general-purpose directory such as Downloads, where files from untrusted sources pile up. Because the attack needs no exploit code, ordinary malware scanning may not catch it. The safer setup is to keep agent working directories separate from downloaded files and to check which instruction files an agent loads.