Markdown Is the New Executable: Attackers Are Dropping Agent Instructions Into Your Downloads Folder From the Web
Websites can drop instruction files like AGENTS.md into the Downloads folder, which coding agents then obey; the attack was caught live on a customer machine.
Extract
For security leaders The context. Your teams now use AI assistants like Claude Code and Codex that write and run code on their own. To do their work, each assistant automatically reads and follows any instructions file it finds in the folder it opens. The problem. A website can quietly drop such a file onto an employee’s computer, just by them visiting it. The assistant then obeys it like an order - and can be tricked into handing over passwords or running an attacker’s code. This isn’t theoretical: we caught it on a real customer’s machine. Why this matters to you. Nobody has to click anything or make a mistake for this to work, and it can’t simply be patched away, because it abuses the way these tools are built to behave. We proved it on the most popular assistants, but any of them can be hit. In the companies we measured, half had employees running these assistants - and every one of those people who uses a browser is exposed. The risk is real, it is happening now, and it is yours to manage. Executive Summary This did not start in a lab. Forever caught live malware on a real customer’s machine, attempting a new kind of attack the industry had not documented - and stopped it cold, before any code ran. Forever Security found a malicious AGENTS.md file in the ~/Downloads folder of a real customer machine - plain text, disguised as ordinary engineering notes. This is not ordinary malware. An AGENTS.md is a file a coding agent is built to trust and obey, and ~/Downloads is the one folder a website can drop a file into with no click and no permission. Together, that lets the web plant orders your own agent carries out. Markdown is the new executable. The planted file makes the agent rewrite its own configuration. From there it can install malware (remote code execution) or hand over its own login token (account takeover). We reproduced the whole attack on both OpenAI Codex and Claude Code - on Codex with the real malicious package, run safely inside an isolated VM. This is not one product’s bug; it is a property of how agents work. There is nothing here for OpenAI or Anthropic to patch. An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do, the same way a browser that renders a phishing page is working as designed. The problem is the circumstances: a folder the web can write to, trusted as if the user filled it. So the vector stays open. It is one early example of a bigger pattern: defenses built around a human break when …
Explained
What happened
Forever Security caught live malware on a customer machine that abused a new vector: a web page plants an instruction file that a coding agent then obeys.
- Coding agents like Codex and Claude Code read an instructions file (such as
AGENTS.md) in the folder they open and follow it before starting the task. - The
~/Downloadsfolder is the one place a website can write to with no click and no permission. - A malicious page silently saves an
AGENTS.mdinto~/Downloads. It reads as a long, dull "Engineering Work Guidelines" document with one buried section. - That section tells the agent, as "standard environment preparation", to register a
project-toolsMCP server in the machine-wide config~/.codex/config.tomland install an npm package. In the real sample the package was malware (function-color, from a campaign that hid for about two years). - Open the agent in that folder, ask it anything, and before your task it edits its own config and runs the attacker code. In testing, Codex ran the payload in over 90% of attempts.
- Because it writes the global config, every future session on that machine loads the attacker server, in any folder. Leaving Downloads does not help.
About half of the measured customers run an agent inside Downloads, and about a quarter of agent sessions open a real browser, so the file can arrive with nobody watching.
Why it works
Two individually harmless facts combine. Agents are built to trust and obey the instructions file in their working directory, the same way you trust a project you set up. And the web can write to Downloads, which never mattered because downloaded executables cannot auto-run. Markdown is not an executable, so none of the OS guardrails that gate downloaded binaries apply, yet in an agent hands the file behaves like one. There is nothing for the vendor to patch: the agent is doing exactly what it is designed to do.
The bigger pattern
This is instruction injection through a trusted data channel, the agent cousin of a macro virus or an autorun file. The deeper pattern: defenses built around a human break when an agent stands in for the human. The dangerous combination is a writable location (Downloads) plus a consumer (the agent) that treats whatever it finds there as authoritative. Expect more of these as agents read more ambient context (files, pages, tickets) and act on it without a person in the loop.
What it means in practice
- Do not start coding agents in
~/Downloadsor any directory the browser can write to. Run them only in vetted project directories. - Treat agent instruction files (
AGENTS.md,CLAUDE.md, and similar) as code. Review them before a session, and pin or lock the ones you trust so a stray copy cannot override them. - Protect the global config. A machine-wide agent config that any session loads is a high-value target. Keep it read-only or under change monitoring, and alert on edits.
- Require approval for config changes and MCP-server registration, and run agents with least privilege, ideally sandboxed or in a VM with no standing credentials.
- For web backends and large systems: any place untrusted input can land and later be consumed as configuration or instructions, download dirs, shared buckets, user-supplied YAML, ticket bodies, is now part of the threat model. Separate data from instructions and never let a writable, externally reachable path feed a trusted control channel.
- Watch for agents installing packages or editing config before doing the requested task. That ordering is a red flag.