Your AI agent takes orders from the Downloads folder

Picture an analyst at a franchise support center on a Tuesday morning. They export last month’s sales by location from the point-of-sale system. The file lands in Downloads, like every file does. They open a terminal, start Codex or Claude Code right there, and ask it to clean up the export and build the royalty comparison.

That’s the shortest path from the file to the answer, and plenty of people take it. It’s also the exact setup a security firm caught being used against one of its customers last month.

What happened

AI coding agents like OpenAI’s Codex and Anthropic’s Claude Code read an instruction file from whatever folder you start them in. Codex looks for AGENTS.md. Claude Code looks for CLAUDE.md. That’s a feature: a project’s instructions travel with the project, and the agent treats what’s in the file as direction from you.

Downloads is where the internet writes to your computer. Chrome, Edge and Firefox all save files there by default without asking.

On October 22, Forever Security published what they found on a customer’s machine: an AGENTS.md in the Downloads folder that nobody remembered putting there. It read like ordinary engineering notes. One section told the agent to add a new tool to its own setup and install a package called function-color, known malware sitting on npm, the public library developers pull code from. Forever’s monitoring stopped it before anything ran. Nobody could work out how the file got there.

Then they tested it. On an isolated machine, using the real attacker’s file, Codex ran the malware in more than 90% of attempts. Worse, the change went into Codex’s machine-wide settings, so it would come back in every later session, in any folder. A planted CLAUDE.md got Claude Code to quietly send its traffic to a server the researchers controlled about half the time, which handed over the login token for the account. Those are lab numbers, not a measured rate of break-ins in the wild. I’d still take them seriously.

Forever’s own conclusion: “There is nothing here for OpenAI or Anthropic to patch.” The agents did what they were built to do. They followed the instructions in the folder they were pointed at.

Why it lands harder at a franchisor

Developers mostly start agents inside a project folder, out of habit. At a franchise support center, the people picking these tools up fastest often aren’t developers. Marketing ops, analytics, whoever owns the CRM, the one IT generalist covering 150 locations. They work where their files are, and their files are in Downloads, because that’s where every export from the point-of-sale system, the CRM, the ad platforms and the franchise development portal ends up.

The other difference is reach. The agent runs with whatever that person can get into, and at the franchisor that’s usually the whole network: the admin export from the point-of-sale system, every lead in the CRM, the shared drive with royalty reports, logins saved in the browser, an API key left in a config file from the last automation project. When the franchisor runs the stack, one laptop at the support center can touch every location.

And it isn’t only your people. Your agency and your platform vendors have developers running these same agents, often with admin access to your systems.

A habit and a one-page policy

I wouldn’t ban the tools. They’re useful, and banning them mostly pushes them onto personal laptops where you can’t see anything. What I’d put in place instead:

• Never start an agent in Downloads or your home folder. Make one working folder per job, move the export into it, start the agent there. It takes thirty seconds.
• Read any AGENTS.md or CLAUDE.md you didn’t write before an agent gets near it. That includes the ones inside a folder a vendor or agency sends over.
• Leave the approval prompts and the sandbox on. If anything tells you to turn them off (a file, a vendor’s setup guide, the agent itself), that’s the red flag. In Forever’s test, the payload had Codex write its own command to skip both.
• Have IT or your managed service provider check the agent settings on support-center machines for servers or web addresses nobody set up. For Codex that’s ~/.codex/config.toml; for Claude Code, .claude/settings.json. If function-color shows up anywhere, treat the machine as compromised and change every password and key it held.
• Write down who uses agents, on which machines, with which logins. One page. Agencies and vendors who work in your systems go on it too.

The question for your vendors

Add one line to the next security questionnaire: do your developers use AI coding agents on systems that hold our data, and what rules do they follow? A good vendor has an answer ready. A vendor who has to go find out has told you where they are.

Agents take instructions from whatever folder you hand them. At a franchisor, that folder often sits one click away from the whole network’s data, so pick it on purpose. If you’re writing the agent policy for your support center and want a second read, send it over.