Your Downloads folder can give orders to your coding agent
A coding agent on a customer's machine tried to install a rogue npm package. The order came from a file named AGENTS.md sitting in the Downloads folder, the one folder a web page can write to on its own.
What happened
Forever Security, which monitors AI agents for its customers, traced an install of the malicious npm package "function-color" to an AGENTS.md file in the customer's ~/Downloads folder, which was also the agent's working directory (BleepingComputer). Agents load instruction files like AGENTS.md and CLAUDE.md from the folder they start in and follow them: which tools to use, which commands to run.
The researchers could not tell how the file got there. Their point is that it doesn't take much: "~/Downloads is special. It is the one folder the web can write to on its own." Chrome, Edge and Firefox save downloads there without asking by default (they do show a notification). Their proof-of-concept page dropped an AGENTS.md silently; Brave asked for approval first.
It works, often
- Against OpenAI Codex, the rebuilt attack chain opened the calculator (a harmless payload) in 90% of runs.
- A malicious CLAUDE.md redirected Claude Code's API traffic to the researchers' server, exposing its OAuth token; the server then posed as the model and got code executed in about 50% of tests.
- Hundreds of their customers run agents, including Codex, Claude Code and Cursor CLI, from ~/Downloads. Claude Code alone started more than 1,300 sessions there.
"There is nothing here for OpenAI or Anthropic to patch," the researchers say. The agent is doing what it was built to do.
What to do
One thing to do today: never start a coding agent in ~/Downloads, your home folder or any folder with files you didn't write. Start it in the root of the project it should work on. If you use agents to sort downloads, move the files into an empty folder first and check for AGENTS.md, CLAUDE.md or similar files before you launch.
It is Thursday's OpenAI sandbox story seen from the other side: an agent trusts its surroundings, so the surroundings are the attack surface.
A 10-year-old network beat frontier models on skin cancer
A dermatologist gave 200 biopsy-proven lesions from the public MILK10k set to GPT-6 Astra, Claude Fable 5.1 and Inception v3, a 2015 CNN fine-tuned for about twenty minutes on public dermatology images (Lynch Lab). The CNN named the right diagnosis out of six for 125 (62%); the two LLMs got 84 and 85 (42%). Each LLM had a favorite wrong answer: GPT-6 Astra called 14 of the 30 melanomas basal cell carcinoma. The author flags the limits: 200 hard cases, each LLM run once. Asked as a patient instead, both LLMs said "see a doctor" for 99 and 98 of 100 melanomas, and for harmless lesions too.
Nvidia makes the same kind of argument for robots. Its open Flora models, three fine-tuned Qwen3.5 models, label robot training video for about 72 cents an hour against about $88.50 for GPT-6 Astra, and scored slightly better on a 50-video test (The Decoder). Those costs are Nvidia's projections at $10 per GPU-hour, and Astra still describes robot actions more precisely on some benchmarks.
The price war
OpenAI is pulling big customers from Anthropic with discounts, The Information reports (The Decoder). Rippling moved OpenAI's share of its coding work from 16% to 52%. Replit switched after more than 30% off a contract worth over $100 million a year. DataCamp's CEO says his costs fell 80 to 90%. A US bank got 500 ChatGPT seats for under $7 per user. Anthropic's growth slowed from Q2 to Q3, according to an investor memo.
Eric Schmidt, Niall Ferguson and Lisa Klaassen go further in Foreign Affairs: they compare OpenAI and Anthropic to the East India Companies, chartered traders that answer to governments (The Decoder). US tech companies plan more than $600 billion of AI investment in 2026, mostly on debt, by their count. They name a conflict over Taiwan and TSMC as the biggest threat to the whole supply chain.
Builders
- TorchTPU. Google and Meta open-sourced a native PyTorch backend for TPUs at PyTorch Conference, replacing PyTorch/XLA. The goal is model.to("tpu") instead of model.to("cuda"); vLLM, SGLang and TorchTitan run on it, and Meta plans to move larger LLM workloads to TPUs (InfoQ).
- Agents now use more tokens than people. The Agentic AI Foundation's Mazin Gilbert said agent token use passed human use on February 6 and has grown 14-fold since, against 2.8-fold for humans. InfoQ notes the data comes from one platform, OpenRouter (same article).
- ML Drift. Google open-sourced the GPU engine behind LiteRT, Apache 2.0, covering OpenGL ES, OpenCL, Metal and WebGPU for on-device inference (InfoQ).
- OpenMobile-2. Open phone agents (9B and 27B, on Qwen) trained on more than 110 simulated apps. With the same data, more apps lifted success on unseen apps from 60.7% to 67.5%. The 27B model scores 79.9 on AndroidWorld (The Decoder).
- Research taste. P-Zero Research's TasteVal measures how well models pick and read experiments; the ability has roughly doubled every three months since December 2025. The best model beat 24 human experts on compute efficiency. Jack Clark now puts self-improving AI as early as 2027, a year earlier than before (The Decoder).
The web pushes back
- r/opensource bans AI. "If your project uses AI, is made by AI, or is intended for AI, it's not welcome," the new rules say. Projects must also be a year old with several contributors, and non-English speakers are told to find another community. A rival r/trueopensource has already started (The Verge).
- Google's AI search and publishers. The Verge traces how AI Overviews and AI Mode cut traffic: Similarweb data put The New York Times' share of traffic from search at 35.5%, down from 44% three years earlier (The Verge).
- Grok's Odyssey. Three months after Elon Musk promised a full-length AI film, Grok released seven minutes, now called "Episode 1." TechCrunch's verdict: a few shots look real, the whole "feels completely airless" (TechCrunch).
Sources covered
1 story · 19 sources (17 news, 0 company, 2 voices)