Malicious AGENTS.md in Downloads Can Hijack Claude Code — Scan Tool Released
blitzcrieg11 · reddit · 2026-10-28
Per BleepingComputer, a malicious AGENTS.md in a user's Downloads folder can trick a coding agent into installing a rogue npm package, and a CLAUDE.md can point Claude Code's API at an attacker's server. Not a bug: agents read instruction files from the startup directory and act with existing permissions.
Defenses: always start agents in a project folder, and read any instruction file you didn't write.
The author open-sourced agentmetry (Apache-2.0): pip install agentmetry && agentmetry scan checks AGENTS.md/CLAUDE.md/GEMINI.md/.cursorrules in home, Downloads and Desktop, flagging package installs, registry execution, piped downloads, endpoint tampering (ANTHROPICBASEURL, proxies, hooks, .mcp.json), plus orphan instruction files in Downloads/Desktop. Plain-text instructions with no installs or configs remain undetectable.
More from coding & agent
- Parent and first-grader build an addictive math game with a one-shot Claude prompt — neuroecology · 2026-10-29
- Man automates Hinge with Claude Code and a spare Android, gets 20-25 matches a day — pritisinghhhh · 2026-10-29
- Dev says OpenAI Dot plus a 24/7 Mac mini made his life 15% better — willdepue · 2026-10-29
- 3 guardrails before letting AI coding agents merge to production — Arindam_1729 · 2026-10-29
- EverOS Cloud hands-on: persistent memory lets Claude recall shop policies across new chats — Aiden_Tech_Ai · 2026-10-29
- Ziplime: new Python library for AI-driven algorithmic trading and backtesting — mdancho84 · 2026-10-29