Stop opening your AI agent in Downloads

Quick question 👇 where do you start your AI coding agent from?

If the answer is "whatever folder the terminal opened in" and sometimes that is Downloads... read this.

Researchers at Forever Security showed that a file called AGENTS.md or CLAUDE.md sitting in your Downloads folder can take over Codex, Claude Code or Cursor CLI. These files are normal, agents read them as instructions for the project. So a web page drops one there with a normal browser download (Chrome, Edge, Firefox, all of them), later you open the agent in that folder, and it does what the file says. Install a rogue npm package. Steal OAuth tokens. Run code.

In their tests code execution through Codex worked around 90% of the time. And their telemetry saw over 1,300 Claude Code sessions launched from Downloads. 1,300!!

❌ The worst part? There is no patch. The agents behave as designed. AND TECHNICALLY THAT IS TRUE. The agent is doing its job, reading the instructions it trusts.

Same thing I keep repeating here. You don't hack the AI. You hack what the AI reads.

👉 One folder per project. Open the agent there. Not in Downloads. Takes 5 seconds.

Aviatrix has the longer write up if you want the details: aviatrix.ai

Small habit. Be careful :)