AI coding agents hijacked using AGENTS.md file in Downloads folder

Researchers found a malicious AGENTS markdown instruction file in a customer’s Downloads folder that tricked an AI coding agent into installing a rogue npm package. They reproduced the attack against OpenAI Codex and demonstrated a related technique against Claude Code to leak OAuth tokens and hijack the account using only the malicious instructions. Markdown files such as AGENTS.md are plain-text files that contain project-specific instructions for AI coding agents, such as the tools to use, how to run tests, and the coding conventions to follow. Agents following malicious instructions Researchers at Forever Security, a company that monitors for risks introduced by AI agents and autonomous software, discovered the tactic on a customer’s computer, where a coding agent attempted to install the malicious npm package ‘function-color.’ The investigation traced the AI agent’s attempt to install a malicious npm package to an AGENTS.md file in the customer’s ~/Downloads folder, which also served as the agent’s working directory. Agents automatically load applicable files from their working directory and use the contained instructions to guide their actions. While these files aren’t executables, malicious instructions contained in them can lead to AI agents running commands, installing packages, or changing settings using the tools and permissions available to it. "There is nothing here for OpenAI or Anthropic to patch. An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do," the researchers say. The researchers' test confirmed that an attacker could use such a file to manipulate OpenAI Codex and Claude Code into executing code or stealing credentials. Although the researchers could not determine how the malicious instructions file landed into the target's /Downloads location, they explained to BleepingComputer that simply visiting a malicious page could drop a payload without any user interaction. In a report this week, Forever Security says that "/Downloads is special. It is the one folder the web can write to on its own," and that "a web page can download a file named AGENTS.md into your Downloads folder, silently." The researchers created a proof-of-concept (PoC) to demonstrate how the attack could land a malicious file into the ~/Downloads location without the user noticing. When BleepingComputer verified the PoC page, it downloaded an AGENTS.md file containing harmless content, namely the strings "sensitive data here" …