Stop launching your coding agent from Downloads. Here is a 30-second pre-flight check.

A malicious AGENTS.md in your Downloads folder can steer a coding agent into installing malware or redirecting its API traffic. No exploit involved. Run this pre-flight check before every session.