A web page can drop an AGENTS.md into ~/Downloads and hijack a coding agent started there

Forever Security traced a customer's agent trying to install the malicious npm package function-color to an AGENTS.md in ~/Downloads, its working directory, then reproduced the attack on Codex (90% success with a harmless payload) and used a malicious CLAUDE.md to leak Claude Code's OAuth token. There's nothing for vendors to patch, so start agents in the project root, never ~/Downloads, and read unfamiliar instruction files first.