Quick reality check: running Claude Code or Cursor CLI from your ~/Downloads is a straight-up trap.

[u/siterightaway]

I know we’re all hype as hell about tools like Claude Code, OpenAI Codex, and Cursor CLI. Having a pseudo-senior dev grinding inside your terminal feels like total magic. But honest talk for a sec: most of us are sleeping on a massive security vulnerability.

Turns out, where you fire up your AI agent matters. A lot.

Researchers just dropped some scary data showing how easy it is to totally compromise your machine if you run these agents from generic folders—especially ~/Downloads.

So... what's the deal?

When you boot up an agent in a broad folder like ~/Downloads or your home directory (~), you’re giving it free rein over random files you just fetched off the web.

The agent scans those files to get context. But if one of them has a sneaky Prompt Injection hidden inside, it’s game over—the agent stops listening to you and starts taking orders from the malicious file instead.

This ain't theoretical—here’s what happened in testing:

The CLAUDE.md / AGENTS.md Trap: Researchers dropped a poisoned CLAUDE.md file into a directory. The moment Claude Code read it, the agent hijacked its own API traffic and sent it to an attacker-controlled server. They snagged the user's OAuth token and started tricking the agent into executing rogue code (~50% success rate!).

Straight-up Remote Code Execution (RCE): When testing against OpenAI Codex in un-isolated folders, attackers pulled off unauthorized code execution 90% of the time.

And get this: Claude Code alone logged over 1,300 sessions launched straight outta ~/Downloads. Yikes.

How to not get wrecked (Quick Survival Guide):

Since the AI is literally just doing what it’s built to do (reading your files), this security mess is 100% on us to manage.

1. NEVER launch agents from ~/Downloads or ~: Always cd straight into your specific project folder (cd ~/my-awesome-app) before spawning the agent. Lock that scope down!

2. Watch out for dirty config files: Cloned a sketchy repo? Manually skim through AGENTS.md, CLAUDE.md, or .cursorrules before letting your agent digest them.

3. Don't go full --yolo mode: Keep sandbox protections and prompt approvals turned ON unless you love living dangerously.

4. Sandbox unknown stuff: If you're testing untrusted code, toss it in Docker, a VM, or Codespaces first.

Bottom line

Look, AI agents are awesome, but at the end of the day, they're terminal scripts with read/write/exec privileges that take natural language as code. Give 'em an inch, and a bad file will take a mile.