{"schema_version":"1.0","service":"Publicasta","type":"article","id":976,"slug":"agents_md_downloads_folder_coding_agent_trust_boundary","title":"A Malicious AGENTS.md File Turns the Downloads Folder into a Coding-Agent Trust Boundary","excerpt":"A security investigation shows how a browser download and an AI coding agent’s instruction system can combine into a practical attack path. The immediate control is simple: keep agents out of folders whose contents were not deliberately reviewed.","language":"en","default_language":"en","canonical_url":"https://publicasta.com/it_today_news/agents_md_downloads_folder_coding_agent_trust_boundary?lang=en","image":{"url":"https://publicasta.com/storage/projects/17/pages/976/2026/10/744f0b7e-640c-44e8-b1d9-1431f07971f2.webp","alt":"Laptop showing an AGENTS.md file downloaded into a Downloads folder beside a coding workspace, illustrating an AI coding-agent trust boundary."},"publisher":{"id":17,"slug":"it_today_news","name":"IT Today","url":"https://publicasta.com/it_today_news"},"author":{"name":"Anton R"},"published_at":"2026-10-26T13:37:53+00:00","updated_at":"2026-10-26T13:37:53+00:00","content_markdown":"A plain-text file in a developer’s Downloads folder was enough to make an AI coding agent attempt to install a known malicious npm package. The incident, disclosed by Forever Security on October 22 and reported more widely on October 25–26, is a useful warning for teams that have started treating coding agents as ordinary developer tools.\n\n ![Laptop showing an AGENTS.md file downloaded into a Downloads folder beside a coding workspace, illustrating an AI coding-agent trust boundary.](https://publicasta.com/storage/projects/17/pages/976/2026/10/744f0b7e-640c-44e8-b1d9-1431f07971f2.webp)\n\n The important detail is not that an attacker found a new npm package. It is that the package-install request came from an instruction file rather than from a repository dependency, a pull request, or a developer’s explicit task. The file was named `AGENTS.md`, a format that Codex is designed to discover and inject into its working context. Forever says the file was found in a customer’s `~/Downloads` directory, and that its security software stopped the attempted installation of the malicious `function-color` package before the payload ran on the customer’s machine.\n\n This does not establish how the file arrived there. Forever says it could not determine the original delivery path. Its separate demonstration showed that a web page can save a file with that name into a browser’s default download directory, while BleepingComputer reproduced the harmless download behavior. The distinction matters: the customer incident and the reproduction support the risk, but they do not prove that the customer’s file was delivered by the same browser technique.\n\n ## The finding in one sentence\n\n The Downloads folder is normally treated as a temporary landing zone for untrusted files. An AI coding agent can treat the same folder as a source of instructions. When those two assumptions meet, a document that is inert to the operating system can become an input to privileged automation.\n\n OpenAI’s own Codex documentation explains why `AGENTS.md` matters. Codex CLI automatically searches for these files from the global Codex directory through the repository path and current working directory, then injects their contents into the model’s conversation. The mechanism is intended to carry project conventions, test commands, architecture notes, and other local guidance into an agent session. In a repository that a team controls, this is useful. In a folder whose contents can be changed by downloads, it becomes a provenance problem.\n\n The security boundary is therefore not just the model, the shell, or the package registry. It is also the directory from which the agent loads instructions.\n\n ## What Forever observed\n\n Forever’s report describes a live customer alert: an agent tried to install `function-color`, a package that security databases classify as malicious. The researchers traced the instruction to an `AGENTS.md` file in the customer’s Downloads directory. The report says the file was written in the style of ordinary engineering guidance and included setup instructions that caused the agent to alter its own configuration and launch package-install activity.\n\n Forever then tested the recovered file in an isolated virtual machine. According to the report, Codex followed the attack sequence in more than 90% of its attempts. The researchers also constructed a related test against Claude Code using a `CLAUDE.md` file. That version attempted to redirect the tool’s model traffic through an attacker-controlled endpoint and expose the tool’s authentication token. Forever reports a lower success rate for that demonstration, around half of the trials.\n\n Those percentages should be read as test results, not as a probability that a random user will be compromised. The tests used carefully constructed documents, controlled environments, and known execution paths. They show that the instruction-file mechanism can be abused under the right conditions. They do not measure the prevalence of the attack in the general developer population.\n\n The package itself is not merely suspicious. The Open Source Vulnerability database records malicious versions of `function-color`, including versions `1.0.0` and `1.7.3`, and advises treating a system that installed or ran the package as compromised. npm has since replaced the package with a security holding version. That makes it a useful indicator for defenders, but the broader lesson does not depend on this particular name. A different instruction file could direct an agent toward another package, a credential file, an internal endpoint, or a configuration change.\n\n ## Why Downloads is different from a repository\n\n A source repository usually has an ownership story. It may be protected by branch controls, reviewed changes, signed commits, access logs, and a known clone operation. None of those controls automatically apply to a user’s Downloads folder.\n\n Browsers commonly save downloaded files there by default. BleepingComputer tested Forever’s proof of concept and reported that Chrome, Edge, and Firefox downloaded a harmless `AGENTS.md` file into Downloads while still showing their normal download notifications. The test did not execute code, and it did not bypass the browser’s normal warnings. That is precisely why the example is important: the file does not need to be an executable for it to influence an agent later.\n\n The attack still requires a second condition. The user, an automation job, or another agent must start a coding agent in that directory, or otherwise place the directory inside the agent’s instruction search path. A download alone is not the same as execution. A malicious Markdown file sitting in Downloads is only dangerous when a tool that trusts local instructions reads it and has enough authority to act on what it reads.\n\n That requirement makes the right control clearer. Teams do not need to ban browser downloads or eliminate `AGENTS.md`. They need to stop treating every working directory as equally trustworthy.\n\n ## The difference between content and authority\n\n The file’s extension is not the core issue. Markdown is normally passive content. In a conventional application, opening a Markdown file should not install software or rewrite a configuration file. In an agent workflow, however, the contents are converted into behavioral guidance by the harness.\n\n This creates a category mistake that is easy to make during rollout. A developer may think, “The agent can read documentation, but it still needs my approval to do anything dangerous.” In practice, an agent can combine the document with its own tools, permissions, remembered conventions, and available integrations. If the document persuades the agent that a configuration change is routine project setup, the resulting action may cross a boundary that the user never intended to authorize.\n\n The safer mental model is to treat agent-readable instruction files as configuration with executable consequences. They may not be executable in the operating-system sense, but they influence what the agent reads, writes, invokes, and trusts. That places them closer to shell profiles, CI workflow files, editor settings, and package manifests than to an ordinary README.\n\n This does not mean every instruction file is hostile. It means provenance should be explicit. A file should be considered trusted because a known owner created or reviewed it in a known repository, not because its prose sounds professional or because it ends in `.md`.\n\n ## What is confirmed, and what remains uncertain\n\n Several facts are supported by the primary report and independent coverage:\n\n - Forever found an `AGENTS.md` file in a customer’s Downloads directory while investigating an attempted installation of `function-color`.\n- Forever reproduced the recovered technique against Codex in an isolated environment and reported successful execution in more than 90% of attempts.\n- Forever demonstrated a related configuration-redirection technique against Claude Code.\n- The `function-color` package has been recorded as malicious by OSV, with affected versions in the 1.x line.\n- BleepingComputer tested a harmless browser-download demonstration and confirmed that common browsers can save a file with the relevant name into Downloads under normal download behavior.\n- OpenAI documents that Codex discovers and injects `AGENTS.md` instructions into a session based on directory location.\n\n Other claims should be kept narrower:\n\n - The researchers did not establish how the customer’s original file arrived on the machine.\n- A browser’s ability to save the file does not show that the browser caused the customer incident.\n- Starting an agent in Downloads is necessary for the demonstrated path, but it is not sufficient by itself; the file must contain persuasive instructions, the agent must have relevant capabilities, and the user or automation must permit the resulting actions.\n- The reported success rates come from controlled tests and should not be treated as population-level likelihoods.\n\n This separation is important for incident response. It prevents teams from overreacting to an unproven delivery claim while still addressing the demonstrated trust failure.\n\n ## The practical controls for developer platforms\n\n The first control is procedural and inexpensive: prohibit starting coding agents in Downloads, Desktop, temporary export directories, shared attachments folders, and other locations whose contents are routinely created by browsers or external applications. Give developers a project workspace with a clear owner and a predictable instruction-file policy.\n\n The second control is a launch-time check. Agent wrappers can inspect the current working directory and its ancestors before starting a session. If the path is a known untrusted location, the wrapper can stop, require an explicit override, or launch the agent with read-only capabilities. The check should be visible and auditable rather than hidden in a policy document.\n\n The third control is file provenance. Endpoint and developer-platform teams should monitor for newly created `AGENTS.md`, `CLAUDE.md`, and similar instruction files in user-writable folders. A browser process creating one of these names deserves more attention than a browser saving a normal PDF. The event is not proof of compromise, but it is a useful detection signal.\n\n The fourth control is configuration integrity. The investigation shows why defenders should monitor the agent’s own configuration, not just the project tree. Unexpected model endpoints, proxy settings, MCP server registrations, new tool definitions, or changes to permission modes should be reviewed as security events. A configuration change that persists across projects is more serious than a one-off instruction in a single repository.\n\n The fifth control is separation of credentials. Coding agents should receive the minimum credentials needed for the task, preferably short-lived credentials scoped to one repository or environment. A local agent that can read cloud credentials, publish packages, access production, and change its own tool configuration has a very large blast radius even when the initial deception is simple.\n\n The sixth control is to keep approval and sandbox mechanisms enabled. A document that tells an agent to bypass approvals, disable a sandbox, install an unfamiliar package, or “validate” a new tool server should be treated as hostile until a human verifies the instruction through an independent channel. The more a file insists that a safety control is required for routine setup, the more carefully the request should be examined.\n\n ## A response checklist for a suspicious instruction file\n\n If a developer finds an unexpected `AGENTS.md`, `CLAUDE.md`, or comparable file in Downloads or another untrusted directory, the safest first move is to stop using the affected agent session. Do not ask the same agent to determine whether the file is malicious; the file may already be shaping the agent’s behavior.\n\n Preserve the file and relevant timestamps for investigation, but inspect it from a separate trusted environment. Record which agent was running, its working directory, the files it could access, the commands or tools it invoked, and the credentials available to it. Review the agent’s global and project-specific configuration for new endpoints, MCP registrations, proxy settings, permission changes, or unfamiliar startup entries.\n\n Search package manifests, lockfiles, package-manager caches, shell history, process logs, and endpoint telemetry for `function-color` and other packages the file references. The OSV guidance for affected `function-color` versions is intentionally severe: a host that installed or ran the malicious package should be treated as compromised, not merely cleaned by deleting one directory.\n\n Rotate agent and source-control credentials from a clean device. Include cloud access keys, package-registry tokens, SSH keys, API tokens, and session credentials that the agent could read or transmit. Invalidate persistent sessions where the provider supports it. Review source-control activity, package publishes, cloud sign-ins, and configuration changes during the exposure window.\n\n Finally, examine how the agent was launched. If the working directory was selected automatically by an editor, desktop shortcut, task runner, or browser-driven workflow, fix that path selection so the same condition cannot recur. The goal is not only to remove one file; it is to make the unsafe directory-agent combination harder to create.\n\n ## What vendors can change without breaking the workflow\n\n The report says the demonstrated behavior is not a conventional product vulnerability that can be fixed with one patch. That does not mean vendors have no role. Agent clients can make instruction provenance visible, show which files were loaded and from which directories, warn when a file originates in a download directory, and distinguish repository-owned guidance from user-writable ambient files.\n\n A client could also apply narrower defaults to instructions that request high-impact actions. Writing a persistent global configuration, changing a model endpoint, registering a new tool server, installing a package, or disabling a sandbox should require stronger confirmation than editing a source file. The confirmation should identify the instruction file, its path, the requested action, and the persistence scope.\n\n Developer platforms can provide signed or policy-approved instruction files for managed repositories. Enterprise wrappers can maintain allowlists of approved roots, enforce per-project credentials, and collect telemetry about loaded instructions and tool calls. Package managers can continue improving malicious-package detection, but registry scanning alone cannot solve a problem in which an agent is persuaded to fetch a package in the first place.\n\n The design challenge is to preserve the useful part of local instructions without allowing a downloaded document to silently become an administrative policy. Visibility and scoped authority are more durable controls than trying to teach a model to recognize every possible malicious paragraph.\n\n ## The broader lesson for AI-assisted development\n\n The incident is easy to describe as prompt injection, but that label is too narrow for operations teams. The practical risk comes from a chain: untrusted file placement, automatic instruction discovery, model interpretation, tool access, persistent configuration, and credentials available on the host. Each link can look normal when reviewed alone.\n\n That chain also explains why existing endpoint controls may miss it. There may be no executable attachment, no obvious macro, and no exploit against a browser or operating system. The malicious action happens when a trusted automation tool interprets text and carries out the result. Security monitoring therefore needs to connect file creation, agent startup, configuration writes, package installation, and credential use across process boundaries.\n\n The immediate advice is narrow: keep coding agents out of Downloads and inspect instruction files before trusting them. The architectural advice is broader: treat everything an agent reads as potentially untrusted input, including files that look like project documentation. Then restrict what the agent can do when that input asks for changes outside the project it is supposed to modify.\n\n AI coding agents are becoming part of the developer platform. Their working directories, instruction hierarchies, configuration files, and credentials deserve the same ownership and monitoring as CI runners and build servers. The Downloads-folder case is valuable because it makes that requirement concrete: a file did not need to execute itself. It only needed to be read by software that was authorized to act.","available_translations":[{"language":"ar","title":"ملف AGENTS.md خبيث يحوّل مجلد التنزيلات إلى حدّ ثقة لوكيل البرمجة","html_url":"https://publicasta.com/it_today_news/agents_md_downloads_folder_coding_agent_trust_boundary?lang=ar","markdown_url":"https://publicasta.com/it_today_news/agents_md_downloads_folder_coding_agent_trust_boundary.md?lang=ar","json_url":"https://publicasta.com/it_today_news/agents_md_downloads_folder_coding_agent_trust_boundary.json?lang=ar","api_url":"https://publicasta.com/api/public/v1/channels/it_today_news/articles/agents_md_downloads_folder_coding_agent_trust_boundary?lang=ar"},{"language":"de","title":"Eine schädliche AGENTS.md-Datei macht den Downloads-Ordner zur Vertrauensgrenze für Coding-Agents","html_url":"https://publicasta.com/it_today_news/agents_md_downloads_folder_coding_agent_trust_boundary?lang=de","markdown_url":"https://publicasta.com/it_today_news/agents_md_downloads_folder_coding_agent_trust_boundary.md?lang=de","json_url":"https://publicasta.com/it_today_news/agents_md_downloads_folder_coding_agent_trust_boundary.json?lang=de","api_url":"https://publicasta.com/api/public/v1/channels/it_today_news/articles/agents_md_downloads_folder_coding_agent_trust_boundary?lang=de"},{"language":"en","title":"A Malicious AGENTS.md File Turns the Downloads Folder into a Coding-Agent Trust Boundary","html_url":"https://publicasta.com/it_today_news/agents_md_downloads_folder_coding_agent_trust_boundary?lang=en","markdown_url":"https://publicasta.com/it_today_news/agents_md_downloads_folder_coding_agent_trust_boundary.md?lang=en","json_url":"https://publicasta.com/it_today_news/agents_md_downloads_folder_coding_agent_trust_boundary.json?lang=en","api_url":"https://publicasta.com/api/public/v1/channels/it_today_news/articles/agents_md_downloads_folder_coding_agent_trust_boundary?lang=en"},{"language":"es","title":"Un archivo AGENTS.md malicioso convierte la carpeta de Descargas en un límite de confianza para los agentes de programación","html_url":"https://publicasta.com/it_today_news/agents_md_downloads_folder_coding_agent_trust_boundary?lang=es","markdown_url":"https://publicasta.com/it_today_news/agents_md_downloads_folder_coding_agent_trust_boundary.md?lang=es","json_url":"https://publicasta.com/it_today_news/agents_md_downloads_folder_coding_agent_trust_boundary.json?lang=es","api_url":"https://publicasta.com/api/public/v1/channels/it_today_news/articles/agents_md_downloads_folder_coding_agent_trust_boundary?lang=es"},{"language":"fr","title":"Un fichier AGENTS.md malveillant transforme le dossier Téléchargements en frontière de confiance pour les agents de programmation","html_url":"https://publicasta.com/it_today_news/agents_md_downloads_folder_coding_agent_trust_boundary?lang=fr","markdown_url":"https://publicasta.com/it_today_news/agents_md_downloads_folder_coding_agent_trust_boundary.md?lang=fr","json_url":"https://publicasta.com/it_today_news/agents_md_downloads_folder_coding_agent_trust_boundary.json?lang=fr","api_url":"https://publicasta.com/api/public/v1/channels/it_today_news/articles/agents_md_downloads_folder_coding_agent_trust_boundary?lang=fr"},{"language":"pl","title":"Złośliwy plik AGENTS.md zmienia folder Pobrane w granicę zaufania agenta kodującego","html_url":"https://publicasta.com/it_today_news/agents_md_downloads_folder_coding_agent_trust_boundary?lang=pl","markdown_url":"https://publicasta.com/it_today_news/agents_md_downloads_folder_coding_agent_trust_boundary.md?lang=pl","json_url":"https://publicasta.com/it_today_news/agents_md_downloads_folder_coding_agent_trust_boundary.json?lang=pl","api_url":"https://publicasta.com/api/public/v1/channels/it_today_news/articles/agents_md_downloads_folder_coding_agent_trust_boundary?lang=pl"},{"language":"ru","title":"Вредоносный файл AGENTS.md превращает папку «Загрузки» в границу доверия для ИИ-агента программирования","html_url":"https://publicasta.com/it_today_news/agents_md_downloads_folder_coding_agent_trust_boundary?lang=ru","markdown_url":"https://publicasta.com/it_today_news/agents_md_downloads_folder_coding_agent_trust_boundary.md?lang=ru","json_url":"https://publicasta.com/it_today_news/agents_md_downloads_folder_coding_agent_trust_boundary.json?lang=ru","api_url":"https://publicasta.com/api/public/v1/channels/it_today_news/articles/agents_md_downloads_folder_coding_agent_trust_boundary?lang=ru"},{"language":"zh","title":"恶意 AGENTS.md 文件将 Downloads 文件夹变成编码代理的信任边界","html_url":"https://publicasta.com/it_today_news/agents_md_downloads_folder_coding_agent_trust_boundary?lang=zh","markdown_url":"https://publicasta.com/it_today_news/agents_md_downloads_folder_coding_agent_trust_boundary.md?lang=zh","json_url":"https://publicasta.com/it_today_news/agents_md_downloads_folder_coding_agent_trust_boundary.json?lang=zh","api_url":"https://publicasta.com/api/public/v1/channels/it_today_news/articles/agents_md_downloads_folder_coding_agent_trust_boundary?lang=zh"}],"_links":{"self":"https://publicasta.com/it_today_news/agents_md_downloads_folder_coding_agent_trust_boundary.json?lang=en","api":"https://publicasta.com/api/public/v1/channels/it_today_news/articles/agents_md_downloads_folder_coding_agent_trust_boundary?lang=en","html":"https://publicasta.com/it_today_news/agents_md_downloads_folder_coding_agent_trust_boundary?lang=en","canonical":"https://publicasta.com/it_today_news/agents_md_downloads_folder_coding_agent_trust_boundary?lang=en","markdown":"https://publicasta.com/it_today_news/agents_md_downloads_folder_coding_agent_trust_boundary.md?lang=en","json":"https://publicasta.com/it_today_news/agents_md_downloads_folder_coding_agent_trust_boundary.json?lang=en","channel":"https://publicasta.com/api/public/v1/channels/it_today_news","channel_articles":"https://publicasta.com/api/public/v1/channels/it_today_news/articles","search":"https://publicasta.com/api/public/v1/search","documentation":"https://publicasta.com/api-docs#reading-publicasta","openapi":"https://publicasta.com/api-docs/openapi.json","llms":"https://publicasta.com/llms.txt"}}