Affected Systems

AI coding agents including OpenAI Codex, Claude Code, and Cursor CLI when launched from ~/Downloads directory. Browsers Chrome, Edge, and Firefox allow silent file downloads to this location. Attack affects users running AI agents in untrusted directories containing malicious .md instruction files (AGENTS.md, CLAUDE.md).

Exploitation Status

Active exploitation observed in the wild. Forever Security discovered malicious AGENTS.md file on customer system attempting to install rogue npm package 'function-color'. Researchers reproduced attack with 90% success rate against Codex and 50% success rate for OAuth token theft against Claude Code. Public PoC available demonstrating silent file drop technique.

Business Impact

AI coding agents can be manipulated to install malicious packages, execute arbitrary code, or leak OAuth tokens when operating from directories containing attacker-controlled markdown instruction files. Attack vector exploits intended browser and agent behavior—no software vulnerability to patch. Risk is highest in development environments where AI agents have elevated permissions and access to source code, credentials, and build systems. Over 1,300 Claude Code sessions launched from ~/Downloads folders observed in researcher telemetry, indicating widespread exposure.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Configure AI coding agents (Codex, Claude Code, Cursor CLI) to launch only from specific project directories, never from ~/Downloads or home directory
  • Enable browser download prompts in Chrome, Edge, and Firefox to require user approval before saving files to ~/Downloads
  • Audit existing ~/Downloads folders for unexpected .md files (AGENTS.md, CLAUDE.md) and remove any unrecognized instruction files
  • Enforce policy requiring manual review of all AGENTS.md and similar instruction files before allowing AI agents to process them
  • Enable and maintain approval prompts and sandbox protections in AI coding agent configurations; test untrusted code in isolated environments before production use