The case

A text file became a route to action

Forever Security says it stopped a coding agent on a customer machine from installing a malicious npm package. Its investigation traced the instruction to an AGENTS.md file in the user's Downloads folder, which was also the agent's working directory. The researchers could not establish how that particular file arrived. They then reproduced ways a web download could plant an instruction file and tested how coding agents responded in isolated environments.

The attack did not need the Markdown file to execute like a program. It needed the agent to read it as trusted project guidance, change its own configuration and run a command with the user's authority. The research also tested a related CLAUDE.md path against Claude Code. Reported success rates describe those tests, not a measured rate of real-world compromise.

Keep the claim narrow

One customer-side attempt was observed and blocked. The browser-delivery chain and broader agent behaviour were reproduced by the researchers; they are not proof that every browser or agent session silently accepts the same sequence.

Field checklist

Treat the working directory as a trust boundary

  1. 1

    Start in the intended project. Avoid launching a coding agent from Downloads, the home folder or another broad collection of unreviewed files. Work from a scoped project directory.

  2. 2

    Review instruction files. Inspect unfamiliar AGENTS.md, CLAUDE.md and similar files before allowing an agent to use them. Pay particular attention to setup commands, package installation, configuration changes and requests to bypass safeguards.

  3. 3

    Watch the configuration. Investigate unexpected MCP server entries, model API endpoints and agent settings, especially after an agent worked in an untrusted folder. Preserve the file and change history if tampering is suspected.

  4. 4

    Keep approvals meaningful. Leave sandbox and approval controls enabled. If the agent installed an unknown package or changed an endpoint, isolate the host, assess exposed credentials and rotate affected tokens.

This is a practical extension of ordinary endpoint hygiene: know what code runs, where it came from, and whose credentials it can use. Agents add one more input to that review—the instructions they read before choosing an action.