On LinkedIn
“Don’t worry, the agent asks before it does anything risky.”
Fine for you. Now picture the colleague who just clicks yes.
Forever Security found an AGENTS.md in the Downloads folder of a real customer machine. Coding agents read that file on startup as orders. Downloads is the one folder any website can write to without a click. Markdown is the new executable.
In their tests, Codex ran the malware in more than 90% of attempts. Claude Code needed a file they wrote specially for it, and still followed through about half the time. Nothing to patch. The agent did what it was built for.
What got me: about half their customers start a coding agent in Downloads.
I would never start one there. My sessions have fixed workspaces and fixed tasks. Context, where I start the session, is everything. In those familiar places I barely read the prompts. They’re known and good.
Would I catch an AGENTS.md someone changed from outside? I don’t know. That one I’m still chewing on. But a request for permissions that don’t belong in that workspace would jump out at me. Of that I’m convinced.
It helps that I understand the question. How is that for someone who spent less time on the command line?
That colleague isn’t careless. Nobody ever told them what mv or grep does. Why would they, they have actual jobs. So what else is that prompt supposed to be?
The prompt is a control for people who already know what normal looks like. For everyone else, it’s a yes button. The real control is where the session starts.
Ask three people on your team which folder they open their agent in. If one says “the desktop”, that’s not better.
The research is Forever Security’s. They found the file on a customer machine and reproduced the attack on both Codex and Claude Code.
The part that did not fit above: Codex wrote the attacker’s server into ~/.codex/config.toml, its machine-wide config. Leave Downloads and the poison comes with you, into every project.
For the doers: never start an agent in Downloads, and check today whether something is already waiting there: find ~/Downloads -name AGENTS.md -o -name CLAUDE.md. Then read your agent’s global config for servers nobody remembers adding.
Earlier, on the support ticket that handed out AWS keys: Phishing for agents.
Markdown files. The attachment nobody warned us about.