A rogue AGENTS.md file can turn AI coding agents against you
Researchers say a malicious markdown file in a Downloads folder can prompt coding agents to install malware or leak session tokens.
A malicious AGENTS.md file placed in a Downloads folder can trick AI coding agents into carrying out instructions written by an attacker, researchers warn. The technique turns a normally harmless-looking markdown document into a prompt-injection launch point. 1
Forever Security told TechRadar that it observed an AGENTS.md file on a real customer machine. The file was disguised as engineering notes but instructed an AI agent to deploy malware and exfiltrate session tokens. The researchers said they reproduced the behaviour with OpenAI Codex and Claude Code. 1
The attack relies on two weak links working together: a website can sometimes place a file in a Downloads folder without a further click, while markdown files are not normally treated as executable threats. An agent that automatically follows AGENTS.md instructions can then mistake hostile text for trusted project guidance. 1
The researchers said the technique is not a conventional software bug for OpenAI or Anthropic to patch. Coding agents are doing what they were designed to do — reading instruction files — but the surrounding file system gives the web a route to plant those instructions. 1
How to reduce the risk
Forever Security recommends treating Downloads folders as hostile ground for agents. Users should not start Codex, Claude Code or similar tools there, and should inspect unfamiliar instruction files before allowing an agent to work near them. Configuration files should also be checked for unexpected proxy addresses or API endpoints. 1
Our opinion
The lesson is less about markdown itself than about trust boundaries. An instruction file is only safe when its origin is understood, yet agent workflows often make local text look authoritative by default. Keeping approval gates, sandboxes and human review enabled is a far more useful defence than pretending a familiar file extension makes a command trustworthy.
This is a source-reported security warning, not evidence that every AI coding tool is actively compromised. 1