A Downloads instruction file redirected a coding agent's setup Forever Security traced a blocked malware install to AGENTS.md. Its tests show why agent configuration changes deserve scrutiny beyond the current folder.