Poisoned Pipeline / Techniques / T0221
Plant agent instructions in a folder the web can write
A browser writes downloads into ~/Downloads with no click and no
permission prompt, and the page chooses the file name and the contents.
That stopped mattering once operating systems began requiring approval
before a downloaded file could execute. It matters again for AI coding
agents: AGENTS.md and CLAUDE.md are plain text that the agent reads on
startup in whatever folder it is opened in and follows as directions,
so markdown behaves like an executable in the agent's hands while none
of the executable-file guardrails apply to it.
The payload is dressed as ordinary engineering notes, because a short
and obvious "install this package" is refused. Forever Security's
captured file is a 13 KB "Engineering Work Guidelines" document with
the attack in one late section framed as routine environment setup.
Once the developer has worked in Downloads the agent trusts that
folder, so the file is obeyed; the agent may also be the thing doing
the browsing, in which case no person is watching the file arrive.
Distinct from T0210, where the attacker writes into agent config or a
project directory the developer set up. Here the delivery is the open
web writing into a folder that is trusted only because an agent was
started in it. Distinct from T0197 as well: nothing here is untrusted
to the agent, which is the whole problem.
Where this idea came from
This catalogue, from Forever Security's capture of a live AGENTS.md in a customer's ~/Downloads (22 October 2026), which drove Codex to register an MCP server that installed the MALFEX package function-color, and from the CLAUDE.md variant the firm reproduced against Claude Code. Delivery is the browser-initiated download - no click, no prompt, page chosen file name - into the one folder a website can write to.
Mitigations
None linked yet.
Detections
None linked yet.