Malicious AGENTS.md files can hijack AI coding agents
Researchers show how an AGENTS.md file downloaded into a working directory can trick AI coding agents into installing malware or exposing credentials.
A malicious AGENTS.md file placed in a user's Downloads folder was enough to trick an AI coding agent into attempting to install a rogue npm package, researchers say. The same technique was used in tests to demonstrate code execution and the theft of OAuth credentials from agent sessions. 1
How the attack works
Researchers at Forever Security traced the incident to a customer whose coding agent was launched from the Downloads directory. The agent found an AGENTS.md file there and treated its contents as project instructions. The file told the agent to install the package function-color, turning an ordinary text file into the starting point for a supply-chain and prompt-injection attack. 12
AGENTS.md files are normally useful: they tell coding agents which commands to run, how a project is structured and which conventions to follow. The danger is that agents may automatically load instructions from the directory in which they start, even when those files arrived through a download and were never reviewed by the user. 1
Forever Security says an attacker could use a web page to download an AGENTS.md file into Downloads without any additional interaction in some browsers. The file is not executable by itself, but the risk appears when a user later starts an agent in that folder and gives it the tools and permissions needed to install packages or change files. BleepingComputer reproduced a harmless version of the download proof of concept. 1
Codex and Claude Code tests
The researchers tested a reconstructed attack against OpenAI Codex with a harmless payload that opened the calculator app, reporting a 90% success rate. In a separate Claude Code test, a malicious CLAUDE.md file redirected API traffic to a server controlled by the researchers. They say this exposed an OAuth token and allowed the server to impersonate the model, with tool calls executing code in roughly half of the tests. 12
Those figures describe the researchers' test conditions, not a universal success rate for every installation. They do, however, show why an instruction file deserves security scrutiny even when it contains no conventional executable code. The agent is the interpreter, and its available tools turn apparently harmless instructions into actions.
The safer workflow
OpenAI and Anthropic recommend launching coding agents from the root of the project they are meant to work on, rather than from Downloads or a broad home directory. A narrowly scoped working directory reduces the chance that unrelated files will be treated as instructions and limits the agent's default context. 1
Users should inspect unfamiliar AGENTS.md, CLAUDE.md and similar files before allowing an agent to follow them. Approval prompts and sandbox protections should remain enabled, and untrusted code should be tested in an isolated environment. The practical rule is simple: Downloads is an inbox for files from the web, not a project root for an autonomous coding tool.
Our opinion
The uncomfortable lesson is that this is not really a bug in one coding assistant. It is a trust-boundary problem created when untrusted files and powerful automation share a working directory. Agents should make instruction provenance more visible, but users can reduce the immediate risk by starting them in the smallest possible project folder and treating every downloaded instruction file as hostile until checked. The attack is avoidable, but only if convenience does not win over a clean working boundary.
Photo by Rafael Minguet Delgado on Pexels: the abstract laptop image used for this story's hero.