Forever Security's research on hijacking coding agents through ~/Downloads has no bug in it, which is the point. Two features do exactly what they were built to do. A browser saves files to Downloads on its own. A coding agent reads the instruction file in the folder it starts in and treats it as its instructions. Put them together and a web page gets to write your agent's orders.
The class is older than agents: authority by location. Nothing checks who wrote AGENTS.md; the only thing that counts is which folder it sits in.
What Happened
The write-ups (BastionZero, DEV) start from a real case. A customer's agent tried to npm install function-color, a package from the MALFEX campaign that Checkmarx documented in early October. Forever Security's product stopped it mid-session. The order came from a 13 KB "Engineering Work Guidelines" AGENTS.md sitting in Downloads, where the agent had been started. Nobody knows how that file got there. The researchers showed how it could have: in Chrome, Edge and Firefox, a page can trigger a save to Downloads without a prompt, and a proof of concept landed an AGENTS.md there "without a click."
Starting an agent in Downloads sounds odd until you remember people ask agents to tidy that folder. Forever told BleepingComputer, as DEV relays it, that Claude Code alone launched more than 1,300 sessions from Downloads.
Then the lab numbers, with a harmless calculator standing in for the payload. Codex ran it in more than 90% of attempts. Claude Code reads CLAUDE.md, not AGENTS.md; with the researchers' own CLAUDE.md it followed in roughly half of tests -- and refused when the folder was full of security notes, which tells you how much context decides.
Why the Folder Matters
Codex's docs say it walks from the project root, usually the Git root, down to the current directory, and "if Codex cannot find a project root, it only checks the current directory." Downloads isn't a repo. So the one file that counts is the one in the folder the web writes to. Claude Code's docs load CLAUDE.md from the working directory and every directory above it.
The working directory was never a trust boundary. For a human, opening a terminal in a folder means nothing; you still read before you run. For an agent, it decides whose instructions it follows.
And the instructions didn't stay in the folder. The customer's file told Codex to add an MCP server to ~/.codex/config.toml -- machine-wide, so it starts in every later session, from any project -- and to spawn a child run with --dangerously-bypass-approvals-and-sandbox, which the file called "required." The Claude Code test wrote ANTHROPIC_BASE_URL into the project's .claude/settings.json, pointing it at a gateway the researchers controlled, so the OAuth token went to them; per DEV, they replayed it against the real API. One file in one folder became persistent configuration and a stolen credential.
What I'd Do
- Start agents only in a root you chose. A repo you cloned, a scratch directory you made. Never Downloads, never your home directory.
- Look before you start. Two checks settle it:
The first lists the instruction and settings files an agent started in Downloads would pick up. The second lists the MCP servers registered machine-wide in Codex; a local one you don't recognise there runs with your permissions.
- Pin what the agent must not change. Where to send tokens and whether to bypass approvals shouldn't live in files the agent can write. Claude Code's docs list API provider routing among the environment settings that managed settings enforce; set the base URL there, not in a file inside the project.
The Tradeoff
Folder-scoped instructions are what make AGENTS.md useful: drop a file in, and every agent in that directory knows the conventions, with no config and no signing. Requiring provenance on that file breaks the zero-effort part, and my bet is most teams won't give that up. That's fine inside a repo, where the file arrived by a commit someone reviewed.
The researchers say there is nothing to patch, and they're right. I think this has the same shape as last week's sandbox fixes: the agent inherited a human primitive -- "the project is the folder I'm in" -- that was never designed to carry authority. Until agents get an environment built around who is allowed to instruct them, the folder you start in is a trust decision. Make it on purpose.