Here is the exact moment of no return. You open a webpage, click nothing, download nothing — and a plain-text file called AGENTS.md is already sitting in your Downloads folder. Then you do the most ordinary thing in the world: cd ~/Downloads, type codex, and ask it to tidy up. Your agent reads the file, decides it is the highest authority in the room, and begins executing instructions a stranger wrote.
That is not a hypothetical. Forever Security found a malicious AGENTS.md in the Downloads folder of a real customer's machine, disguised as ordinary engineering notes, and traced how it tried to get the agent to install a rogue npm package.
Last week we covered agents breaking out of their sandboxes and evading monitoring. This is the opposite exploit class: an agent being talked into opening the door from the inside, using nothing but a file it was built to obey.
An agent being talked into opening the door from the inside, using nothing but a file it was built to obey.
Two things have to be true for this to work, and on their own each is harmless. First, an AGENTS.md is meant to be obeyed — that is the entire point of the file. Second, ~/Downloads is the one folder the web can write to on its own, with no click and no permission, and the attacker even gets to pick the name and contents.
Put them together and a webpage can plant orders in a folder you trust, and your own agent carries them out. In an agent's hands that plain text behaves like an executable. But it is not an executable, so none of the guardrails that stop executables apply.
Here is what the researchers' reconstruction actually found. Codex ran the attacker's payload in more than 90 percent of attempts. A companion CLAUDE.md got Claude Code to redirect its API traffic about half the time, leaking its OAuth token to a server the researchers controlled.
The malicious file was 13 KB of mundane "team local development environment preparation" notes, with the payload slipped in at the end. It is long, boring, and unreadable to a human skimming it — which is precisely the point. A short request to install a package gets refused. A thirteen-kilobyte style guide does not.
Codex read it, agreed it was reasonable, and executed a subprocess with the –dangerously-bypass-approvals-and-sandbox flag. It turned off its own protection.
Worse, what it modified was not a local setting but the global ~/.codex/config.toml. Delete the Downloads folder, open a clean project, and the attacker's command fires again, every session. That is persistence, achieved through a text file.
Claude Code's failure mode was different, and in some ways cleaner. The file asked it to rewrite .claude/settings.json, quietly pointing ANTHROPIC_BASE_URL at an attacker's reverse proxy. Claude Code normally asks a person to approve a change like this and often refuses ones that look wrong. It followed through about 50 percent of the time.
Once that address is live, every request carries the user's login token to the attacker. When the researchers replayed a captured token against Anthropic's service, they were treated as the victim and took over the account without running any code.
The researchers' own conclusion is the part the industry should sit with. "There is nothing here for OpenAI or Anthropic to patch," they wrote. An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do — the same way a browser that renders a phishing page is working as designed.
This is why it is a class, not a bug. You cannot patch a product for behaving correctly. The problem is the circumstances: a folder the web can write to, trusted as if the user had filled it.
And the framing is bigger than two vendors. Every operating-system defense we have built assumes a human is sitting at the screen, reading what arrived and deciding what runs. You want to elevate privileges, the system asks you to click. You want to run an unsigned app, the system asks you to confirm. That assumption held for thirty years.
It is why "don't run .exe" worked as folk security advice for a generation. The download could not run itself, so the human became the firewall.
Agents have removed the human from that loop. They run in directories people never inspect, read every file they find, and act with the employee's own credentials. The very context-awareness that makes them useful — the feature that has them load your project's conventions before you type anything — is the attack surface.
The research community is already mapping the wider terrain. CSA's analysis separates instruction files, which the model reads as guidance, from settings files like .claude/settings.json and .vscode/tasks.json, which the tool acts on directly. A June 2026 supply-chain worm planted both, for Claude Code, Gemini CLI, Cursor and VS Code, inside a Microsoft repository; GitHub disabled 73 repositories across four Microsoft organizations in response.
A preprint study found that only 4 to 16 percent of the security rules developers wrote into public CLAUDE.md files had a matching built-in control that could enforce them. Written rules, in other words, offer almost no backstop.
There is also a quieter variant worth understanding, because it does not need anyone to open a door. A separate study crafted memory files that presented removing defensive checks as ordinary engineering guidance. Across 12 CWE classes, agents generated code that passed its tests and was still vulnerable. One agent named the suspicious file in its final message about two thirds of the time; another mentioned it almost exclusively in its reasoning trace, never in what the developer actually reads.
So the file does not have to hand over a token. It can simply persuade the agent to write worse code, and the developer may never learn why.
The uncomfortable implication is that this stops being a lab topic or a vendor problem. Forever's telemetry found roughly half of its customers run a coding agent inside the Downloads folder, and Claude Code alone launched more than 1,300 sessions from that location. About a quarter of agent sessions open a real browser — which means the agent can visit the page that drops the file, becoming both target and weapon.
The practical advice is blunt and free. Do not start an agent in ~/Downloads or ~/Desktop; treat them as heavily contaminated ground. Read any AGENTS.md or CLAUDE.md you did not write, including in a repository you just cloned. Check your global config for server entries you never added. Keep approval prompts and sandboxes on, and treat any instruction that tells the agent to bypass them as hostile. If you find a planted file, assume your login token leaked and rotate it.
But advice is not a security model, and that is the real story. For thirty years, the deal was that the machine would ask before it acted, and a person would answer. Agents cannot be asked — they are the ones acting. We now have a class of attack that no vendor can close, because the thing being exploited is the product working as intended.
The defense assumption has to be rebuilt from scratch, and in the meantime it lives with each user, in which folder they open, and whether they read the file before their agent does.