I read a story at the weekend that made me want to go and check my own laptop straight away. Researchers at Forever Security found a malicious AGENTS.md file sitting in a customer’s ~/Downloads folder (BleepingComputer has the details). Someone started a coding agent in that folder, the agent did what agents do and read the instruction file it found there, and then it dutifully installed a rogue npm package. No exploit, no zero-day, no clever buffer overflow. Just a Markdown file politely asking the agent to do something bad, and the agent obliging.

The researchers reproduced it against OpenAI Codex with a harmless payload (it opened the calculator) and it worked in 90% of their tests. A related trick with a CLAUDE.md file redirected Claude Code’s API traffic to a server they controlled, which exposed the agent’s OAuth token and let them return tool calls that ran code in roughly half the attempts. And here’s the bit that made me wince: their telemetry showed Claude Code alone had been launched more than 1,300 times from people’s Downloads folders. Why? Because “tidy up my Downloads” is exactly the sort of chore people hand to an agent!

Instructions Are Code Now

Here’s the thing: for 30-odd years us engineers have been trained to be suspicious of executables. Don’t run the .exe from the email, don’t curl | bash a script you haven’t read, and so on. A Markdown file, on the other hand, was always the most harmless thing on your disk. It’s documentation! Nobody ever got hacked by a README.

Well, that’s no longer true. The moment an agent with shell access treats a text file as instructions, that text file is code. It doesn’t matter that it’s written in English rather than Python: it changes what runs on your machine, with your permissions, your tokens and your SSH keys. As such, an AGENTS.md or CLAUDE.md deserves the same suspicion as a shell script, and the folder you start the agent in is effectively its trust boundary.

Bear in mind the researchers point out there’s nothing for OpenAI or Anthropic to “patch” here. Browsers save files to Downloads without asking (that’s a feature), agents load instruction files from their working directory (that’s also a feature), and put the two together and you get a security hole. Two perfectly reasonable defaults combining into an unreasonable outcome is the oldest story in security, and I suspect we’ll see a lot more of it as agents get more autonomy.

What I’d Do on Monday Morning

If I were running an engineering team right now (and I’ve sat in that seat as a CTO), this is what I’d ask for this week, none of which needs a budget:

• Agents start in a project’s root, never in a home directory, Downloads or any other “junk drawer” folder. Write it down as policy, because people won’t guess it.
• Instruction files (AGENTS.md, CLAUDE.md, Cursor rules and the likes) live in the repo and change through pull requests, like any other code. If one appears that nobody reviewed, that’s a red flag.
• Agent permission settings get reviewed too. An allow list that lets the agent push to main or read your secrets folder is a decision, not a default.
• Approval prompts and sandboxes stay on. I know they’re annoying (trust me, I know!), but “the agent kept asking me” is a much better complaint than “the agent installed something”.
• Anything untrusted gets opened in an isolated environment first: a container, a throwaway VM, a cloud sandbox.

None of this is new, by the way. It’s least privilege and code review, which is exactly the point: we don’t need a new security discipline for agents, we need to apply the old one to a new kind of code.

The Same Problem, From the Builder’s Side

I’ve been on the other side of this too, because Calendrz has an agent that reads text written by people it can’t fully trust: you can email the Smart Scheduler and ask it to book a meeting. Email is about the most hostile input there is, so we treat every message as untrusted until proven otherwise. A message has to come from the address of an existing account before the agent even sees it, and unless the email passes both SPF and DKIM checks the agent does nothing until the account owner clicks a one-shot confirmation link. Even then, the agent proposes a time and asks before it creates anything, and its tools are deliberately narrow (it can look for free slots and book events, it can’t go wandering off to install packages).

Is that bulletproof? No, nothing is. But the principle is the same one the AGENTS.md story is screaming about: decide up front which text is allowed to give your agent orders, and treat everything else as data. Don’t get me wrong, I love working with coding agents and I use them every day. I’m just not going to start one in my Downloads folder. Come to think of it, I’m not sure I’ll start one in my home directory either.

Bottom line: if a file can tell your agent what to do, it’s code, so review it like code. Your security team will thank you 😉