AI coding agents hijacked using AGENTS.md file in Downloads folder

Key Points:

• Researchers at Forever Security discovered that malicious AGENTS.md markdown instruction files can trick AI coding agents like OpenAI Codex and Claude Code into installing rogue npm packages or leaking OAuth tokens by following harmful instructions embedded in these files.
• These markdown files, typically used to guide AI agents on project-specific tasks, can be exploited if placed in the AI agent’s working directory, such as the ~/Downloads folder, which browsers commonly use for automatic file downloads without user prompts.
• The attack relies on the AI agent loading and executing instructions from these files when run in the directory containing the malicious file, a behavior confirmed by tests showing high success rates in executing unauthorized commands or stealing credentials.
• Researchers emphasize that this vulnerability stems from intended browser and agent behaviors, placing the onus on users to avoid running AI agents from broad directories like ~/Downloads and instead use project-specific folders to limit exposure to untrusted files.
• To mitigate risks, users should carefully review any unfamiliar instruction files before allowing AI agents to process them, enable approval prompts and sandboxing, and test untrusted code in isolated environments to prevent unauthorized actions on their main systems.