Silent Driveway Exploits: How Malicious Instructions in the Downloads Folder Can Hijack AI Coding Agents

The landscape of software development is undergoing a paradigm shift, characterized by the widespread adoption of AI-powered coding agents. Tools such as OpenAI Codex, Claude Code, and the Cursor CLI have become indispensable companions for millions of engineers, streamlining workflows by writing boilerplate code, executing tests, and managing project dependencies. However, this unprecedented level of automation introduces entirely new attack surfaces. Security researchers have recently uncovered a subtle yet dangerous vulnerability vector that bypasses traditional software vulnerabilities entirely: exploiting the natural operational behavior of AI coding agents through plain-text instruction files planted silently in a user’s Downloads directory.

The Anatomy of the Threat: Weaponizing Project Context Files

Modern AI coding agents do not operate in a vacuum. To be effective, they require context about the codebase they are modifying, the build tools in use, and the specific conventions preferred by the development team. To achieve this, tools commonly look for project configuration and instruction files in their working directory. For instance, platforms like Claude Code scan for files named CLAUDE.md, while other general autonomous agents look for AGENTS.md. These files are written in Markdown and act as human-readable and machine-interpretable manifests, detailing guidelines such as which package managers to utilize, how to trigger test suites, and what architectural rules to enforce.

Crucially, these configuration files are not executables in the traditional sense; they contain natural language prompts and behavioral instructions. When an AI agent loads these files, it parses the text and treats the contents as authoritative operational guidance.

Security researchers at Forever Security, a firm specializing in the risks introduced by autonomous software agents, stumbled upon this vulnerability during a routine investigation of a customer’s machine. Telemetry indicated that an AI coding agent operating on the user’s system had independently attempted to fetch and install a suspicious, rogue npm package designated as function-color. A forensic trace of the incident revealed that the agent had not acted on its own volition or due to a compromised upstream repository; rather, it was faithfully executing instructions located inside an AGENTS.md file sitting quietly within the user’s ~/Downloads folder. The folder was serving as the agent’s active working directory at the time.

Because the agent was designed to ingest and obey instructions found in its local environment, it executed commands to install the unauthorized package, demonstrating how an attacker can leverage an agent’s core functionality against the user.

The Vector: Why the Downloads Folder is a Danger Zone

A core pillar of this attack mechanism relies on the unique security properties of the ~/Downloads directory across major operating systems. Unlike restricted system paths or isolated user directories, the ~/Downloads folder is effectively the primary landing zone for web-based data transmission. It is the one location on a typical workstation where external web content can write files automatically without requiring explicit, step-by-step user confirmation for every individual asset.

While modern web browsers—including Google Chrome, Microsoft Edge, and Mozilla Firefox—have introduced varying levels of download notifications and visual indicators to alert users when a file is saved locally, they do not inherently block background downloads originating from web pages. Utilizing standard browser behaviors, an un-interacted-with malicious website can silently drop a file named AGENTS.md or CLAUDE.md directly into a target’s ~/Downloads path.

To verify the viability of this delivery mechanism, researchers developed a proof-of-concept (PoC) web page. When visited, the page successfully initiated a background download of an AGENTS.md file containing arbitrary strings—such as "sensitive data here"—straight into the default local storage path without prompting the user to select a destination folder. While certain alternative browsers, such as Brave, prompt users to explicitly approve downloads, the vast majority of web traffic flows through browsers that complete these background drops transparently.

Real-World Exposure and Empirical Testing

The danger of a silently dropped instruction file would be minimal if users routinely restricted their AI tools to dedicated, version-controlled project repositories. However, telemetry and internal usage statistics gathered by Forever Security reveal a strikingly different reality. Developers frequently spin up AI coding agents directly inside their ~/Downloads folders, often using the autonomous assistants to clean up messy directories, parse newly downloaded archives, or quickly inspect scripts retrieved from the web.

Internal metrics shared by the researchers indicate that hundreds of active enterprise and individual customers routinely execute tools like Claude Code, OpenAI Codex, and Cursor CLI directly from their ~/Downloads directories. In particular, usage data for Claude Code showed that over 1,300 distinct sessions had been launched from this specific location alone. This widespread operational habit creates a persistent window of vulnerability, marrying an unmonitored file-drop location with a highly privileged, context-hungry automation tool.

To assess the practical risks of this scenario, the research team constructed rigorous attack chains against both OpenAI Codex and Claude Code.

In tests targeting OpenAI Codex, researchers introduced a harmless payload designed to execute the local operating system’s calculator application. Operating under the influence of the malicious local configuration file, Codex successfully followed the directive and launched the application in approximately 90% of the test runs.

In a more sophisticated separate evaluation targeting Claude Code, researchers utilized a malicious CLAUDE.md file designed to covertly redirect the agent’s API traffic toward a designated external server under their control. This man-in-the-middle approach successfully exposed the active session’s OAuth tokens. Armed with these stolen credentials, the remote server was able to impersonate the legitimate user, issue authorized tool calls, and execute arbitrary code on the host machine in roughly 50% of the simulated tests.

The Architectural Reality: Design Intent Versus Abuse

A critical aspect of this security challenge is that it does not stem from a software bug, memory corruption flaw, or protocol failure in the traditional sense. Consequently, there is no conventional patch that AI platform developers like OpenAI or Anthropic can deploy to eradicate the underlying risk.

As the researchers explicitly noted in their findings, an agent that meticulously reads and follows an AGENTS.md or CLAUDE.md file located within its active folder is executing its core design parameters precisely as intended. The software is functioning exactly as engineered; the vulnerability lies in the blending of untrusted filesystem inputs with high-privilege execution permissions.

Because web applications can write to the user’s download directory, and users frequently launch agents in that exact directory, the system inherently trusts text files that may have been authored by malicious third parties. This places the burden of defense and risk mitigation firmly on the end user.

Strategic Recommendations and Best Practices

Securing workflows against context-file hijacking requires a fundamental shift in how developers handle command-line interfaces and autonomous developer tools. Security experts, alongside platform developers, have outlined several critical safeguards to mitigate the risk of accidental agent compromise:

1. Never Use the Downloads Folder as a Working Directory: Developers must strictly avoid launching AI coding agents from ~/Downloads, temporary directories, or general home directories. These locations are exposed to external web traffic and frequently accumulate untrusted files that the agent might mistakenly parse as operational directives.
2. Isolate Project Contexts: OpenAI, Anthropic, and other AI tooling providers strongly recommend initiating AI coding sessions exclusively from within the root directory of a well-defined, specific project. Keeping the agent’s working area structurally narrow limits its filesystem visibility and prevents it from processing unrelated, potentially malicious files.
3. Inspect Configuration Files: Before authorizing an AI agent to execute tasks within a new environment, engineers should audit the working directory for unfamiliar instruction files, including AGENTS.md, CLAUDE.md, or hidden project manifests.
4. Enforce Sandbox Boundaries and Prompts: Users should ensure that default approval prompts remain active, requiring explicit human confirmation before an AI agent is permitted to execute terminal commands, install packages, or modify system configurations. When testing experimental code or unverified repositories, developers should rely on isolated sandbox environments or virtual machines rather than executing instructions directly on primary production hardware.

As autonomous development agents become deeply integrated into the modern software engineering lifecycle, the security perimeter is expanding beyond network boundaries and code repositories into the realm of human workflow habits and local file hygiene. Protecting against these novel exploitation vectors requires a combination of strict workspace discipline and heightened awareness of how ambient data can be weaponized against intelligent systems.