TipDon’t start your AI agent in your Downloads folder: a downloaded text file can take it over
Security researchers have found a new attack on AI agents such as Codex and Claude Code. A web page can drop a file with instructions into your Downloads folder, and if you start the agent there it can be tricked into installing malware or handing over your login. Here is how to protect yourself, and it costs nothing.
On 22 October 2026 the security company Forever Security published a report on a new kind of attack, and on 25 October BleepingComputer covered it. On one of the company’s customers’ computers, an AI coding agent had tried to install a known malicious package, function-color from npm. The order did not come from any code, but from an ordinary text file called AGENTS.md. It was sitting in the customer’s Downloads folder, and the agent had been started in exactly that folder.
Why does it work? Files such as AGENTS.md and CLAUDE.md are instruction files. Agents such as OpenAI Codex and Claude Code read them automatically when they start in a folder and follow what they say, for example which tools to use. That is how they are built. The Downloads folder is special, the researchers write: it is the folder a web page can save a file into without you clicking anything. By default Chrome, Edge and Firefox save downloads there without asking, but they do show a download notification. In BleepingComputer’s test, Brave asked first.
Forever tested the attack for real. Against Codex they ran the genuine malicious file in an isolated virtual machine, and Codex ran malicious code in more than 90 percent of attempts. The change was also written into Codex’s shared settings file, so it carried over to every project on the computer. Against Claude Code they wrote their own file that made the agent send its traffic through a server they controlled. That leaked the agent’s login token, and it worked about half the time.
There is nothing for OpenAI or Anthropic to patch, the researchers write. The agent does what it was built to do, in the same way a browser displays a fake login page. The responsibility falls on the user. According to Forever’s own data, about half of its customers run a coding agent in the Downloads folder, often to tidy the folder or to work on a file they have just downloaded. OpenAI and Anthropic recommend starting the agent in the folder of the project it is meant to work on.
Who is affected? Anyone using AI agents that run on their own computer and read files there, such as Codex, Claude Code or Cursor. More and more small business owners use such agents to sort files or build small tools, even without being developers. The attack requires the agent to be started in the same folder as the planted file. That is why changing a single habit goes a long way.
How to get started
- Never start an AI agent in your Downloads folder. First move the file you want to work on into its own project folder.
- Start the agent in the folder it should work in, not in your home folder or a large folder above it.
- If you find an AGENTS.md or CLAUDE.md you did not write yourself, for example in a project you have just downloaded: read it before the agent works there. Our prompt helps you review it.
- Keep approvals and the sandbox switched on, and be suspicious of anything that asks the agent to turn them off.
- If you are technically minded: check ~/.codex/config.toml and the project’s .claude/settings.json for servers or addresses you did not add yourself. If you find something, sign out and back in, replace your keys, and assume the login has leaked.
More on TipAI
Sources
- Forever Security: Markdown Is the New Executable – Attackers Are Dropping Agent Instructions Into Your Downloads Folder From the Web (22 okt 2026) (retrieved 2026-10-26)
- BleepingComputer: AI coding agents hijacked using AGENTS.md file in Downloads folder (25 okt 2026) (retrieved 2026-10-26)
Free cheat sheet: Get started with AI
A printable page with the basic formula, five things to try and how to use AI safely. Enter your email and we will send it straight away – free, unsubscribe any time.
Get the cheat sheet free →TipAI explains AI in plain language for beginners, families and small businesses. Every article has sources and a "How to get started" section.