AGENTS.md File Attack Targets AI Coding Agents

Researchers found a malicious AGENTS markdown instruction file in a customer’s Downloads folder that tricked an AI coding agent into installing a rogue npm package.

They reproduced the attack against OpenAI Codex and demonstrated a related technique against Claude Code to leak OAuth tokens and hijack the account using only the malicious instructions.

Markdown files like AGENTS.md are plain-text files that contain project-specific instructions for AI coding agents, detailing the tools to use, how to run tests, and coding conventions to follow.

Agents Following Malicious Instructions

Researchers at Forever Security, a company that monitors risks introduced by AI agents and autonomous software, discovered the tactic on a customer’s computer, where a coding agent attempted to install the malicious npm package ‘_function-color_.’

The investigation traced the AI agent’s attempt to install the malicious npm package to an AGENTS.md file in the customer’s ~/Downloads folder, which also served as the agent’s working directory.

Agents automatically load applicable files from their working directory and use the contained instructions to guide their actions.

While these files aren’t executables, malicious instructions contained in them can lead to AI agents running commands, installing packages, or changing settings using the tools and permissions available to them.

According to the researchers, “There is nothing here for OpenAI or Anthropic to patch. An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do.”

The researchers’ test confirmed that an attacker could use such a file to manipulate OpenAI Codex and Claude Code into executing code or stealing credentials.

Although the researchers could not determine how the malicious instructions file landed in the target’s ~/Downloads location, they explained to BleepingComputer that simply visiting a malicious page could drop a payload without any user interaction.

In a report this week, Forever Security stated that “~/Downloads is special. It is the one folder the web can write to on its own,” adding that “a web page can download a file named AGENTS.md into your Downloads folder, silently.”

Proof-of-Concept Demonstration

The researchers created a proof-of-concept (PoC) to demonstrate how the attack could place a malicious file into the ~/Downloads location without the user noticing.

When BleepingComputer verified the PoC page, it downloaded an AGENTS.md file containing harmless content, specifically the strings “sensitive data here” and “line 2.”

By default, many popular browsers, including Chrome, Edge, and Firefox, save files downloaded from the web to the user’s ~/Downloads directory without prompting them to choose a save location for each download.

BleepingComputer’s tests in other browsers, such as Brave, prompted the user to approve the download, which should alert the user that a file was downloaded.

However, Chrome, Edge, and Firefox display download notifications by default, alerting users when a file has been saved locally.

After dropping the file into Downloads, the attack would require the target to launch their AI agent in that same directory so it could load the instruction file and digest its malicious instructions.

Forever researcher Gal Weizman told BleepingComputer that this is common practice, as people often use AI agents to organize that folder or to act on a newly downloaded file.

Weizman noted that internal statistics show that hundreds of customers run AI agents, including Claude Code, OpenAI Codex, and Cursor CLI, from their ~/Downloads folders. Claude Code alone launched more than 1,300 sessions from that location, according to the researcher.

Feasibility of the Attack

The researchers tested their reconstructed attack chain against Codex using a harmless payload that simply opened the calculator app, achieving a 90% success rate.

In a separate test, they used a malicious CLAUDE.md file to redirect Claude Code’s API traffic to a server they controlled. This exposed the agent’s OAuth token, allowing the server to impersonate the model and return tool calls that executed code in roughly 50% of tests.

The researchers assert that the risk stems from the combination of intended browser and agent behavior, placing the responsibility for precaution and defense directly on the user.

Users are advised to avoid setting ~/Downloads as an AI coding agent’s working directory because the location may contain untrusted files that the agent could interpret as instructions.

OpenAI and Anthropic recommend running their AI coding agents from the project directory they are intended to work on.

Keeping the working directory scoped to the relevant project helps provide the agent with appropriate context and limits its working scope, reducing the risk of it processing untrusted files in unrelated locations.

The common recommendation from OpenAI and Anthropic is to start an AI coding agent in the root of the specific project it should work on, rather than in the home directory or a broad parent directory. This approach helps define the agent’s default project context and establishes its filesystem access boundary.

Users should review unfamiliar AGENTS.md, CLAUDE.md, and similar instruction files before allowing an AI coding agent to follow them, keep approval prompts and sandbox protections enabled, and test potentially untrusted code in an isolated environment before running it on their main system.

 

Source: BleepingComputer