Malicious Downloads folder files trick AI agents into running malware

Plain text files stored in a user's Downloads folder can trick artificial intelligence coding agents into altering settings, installing malware, or exposing login tokens, CyberSecurityNews and The Hacker News reported. Security firm Forever Security discovered the vulnerability after stopping an AI coding agent on a customer's system from installing a malicious package named function-color. The Hacker News and FTMQ Security reported earlier that researchers traced the unauthorized command to a malicious AGENTS.md file stored in the user's local Downloads folder. [1][3][11]

Forever Security conducted controlled tests to reproduce the vulnerability across multiple systems, CyberSecurityNews reported. The Hacker News reported that a malicious AGENTS.md file led OpenAI Codex to execute npm malware in over 90 percent of tests. The Hacker News and FTMQ Security noted that a separate attack path targeting Anthropic Claude Code successfully exposed user login tokens. [1][3][11]

Claude Code is a terminal coding agent created by Anthropic, an American software firm that released the Claude language model series in March 2023. As FTMQ Security reported earlier, AGENTS.md files contain machine-readable instructions that AI tools automatically parse and execute, creating an indirect prompt injection vector when untrusted files enter local storage directories. [9][11]