Agents MD

A Web Page Can Plant an AGENTS.md in Your Downloads

On 22 October Forever Security described stopping a coding agent on a customer's machine as it installed the malicious npm package function-color on the instructions of an AGENTS.md in ~/Downloads that nobody had put there; their proof of concept is a web page that saves such a file into Downloads with no click, and BleepingComputer found Chrome, Edge and Firefox do it while only Brave asks. With a harmless canary AGENTS.md in my own Downloads folder, Codex 0.164.0 injected the file only when Downloads itself was the working directory (session rollouts confirm it), while Claude Code 2.1.310 loaded it from Downloads, from a plain subfolder and from a subfolder with its own git repository, because it walks every directory from the working directory to the filesystem root; a repository unzipped into Downloads inherits the planted file. Loading was deterministic but obedience was not (Haiku 3 of 6, Codex 1 of 2). For Claude Code a claudeMdExcludes glob, --setting-sources user, the Project instructions setting, or a project CLAUDE.md kept the file out. Nothing is patched because both agents are reading instruction files exactly as documented.