Markdown Is the New Executable: Attackers Are Dropping Agent Instructions Into Your Downloads Folder From the Web

[u/Content-Winter5328]

https://forever.security/blog/hijacking-ai-agents-via-downloads-folder

[u/ApfelbaumFlo]

I don’t think “text files exist” is the news here. But “half of customers run a coding agent inside their Downloads folder” … by god, we aren’t gonna make it, are we?

[u/Content-Winter5328 → u/ApfelbaumFlo]

You don’t think the combo of two legitimate software behaviors (websites can download a file & claude listens to agents.md) ending up being toxic is interesting?

[u/paul_h]

chrome://settings/downloads .... "Ask where to save each file before downloading" -> enable

[u/Content-Winter5328 → u/paul_h]

Actually, yes

[u/best_of_badgers]

This is not hypothetical. In our telemetry, about half of customers run an agent inside Downloads.

[grimacing emoji]

[u/ventus1b → u/best_of_badgers]

It’s the 2020s version of people storing files in the trash folder.

[u/waterkip]

Couple of feedback things if you are the author: stop reiterating the same thing over and over again. File in downloads, agents, rinse repeat. I stopped reading 

[u/schwar2ss]

Sometimes I wonder if humanity should have all these tools or if we should go back to sticks and stones.

Why on earth are people running their agents in their Download folders? Are they also doing their cooking in the dumpster?

[u/RegisteredJustToSay → u/schwar2ss]

My guess is they've downloaded something and then want an agent to do something with it. "The 2026 spending is in X.csv, do my job". Moving or downloading the file elsewhere would be an additional step. Not defending the practice, but intermediate steps tend to be the first to be eliminated so at least to me it's easy to see how this might be common behavior.

[u/alphaxion]

How long before those irritating digital friends like that damn yeti from 2002 gets resurrected as a skin for your AI agent, and hides these agent.md files inside to run behind their backs?