- Researchers showed AI agents can be hijacked through malicious AGENTS.md files placed in common download locations
- The attack abuses prompt-injection behavior, potentially triggering malware downloads or token theft
- Defenders are urged to treat Downloads folders as untrusted and inspect agent instruction files carefully
An AI agent was tricked into going rogue with nothing more than a simple markdown (.MD) file, with researchers warning this file format is the new malicious executable. With just a basic .MD file and access to a website, threat actors can get people’s agents to execute malicious code or share access tokens.
Researchers Forever Security claim to have seen the attack play out in the wild, but stopped it before it was able to do any meaningful damage. To pull it off, the attackers took advantage of a couple of things: 1) the fact that websites can download some file formats without user’s knowledge or consent; 2) the fact that .md files are not seen as malicious or dangerous by default; 3) the fact that AI agents will act on anything that’s written in the AGENTS.md file, regardless of what it’s inside.
In its report, Forever Security said it caught live malware on a real customer’s machine – an AGENTS.md file in the ~/Downloads folder. The document, disguised as ordinary engineering notes, was everything but ordinary – it turned the AI agent rogue, ordering it to deploy malware and exfiltrate session tokens.
Working on Codex and Claude Code
The researchers could not determine how the file made it to the Downloads folder and are assuming a browser picked it up from a website that was likely compromised in advance.
“Downloads is the one folder a website can drop a file into with no click and no permission. Together, that lets the web plant orders your own agent carries out. Markdown is the new executable,” the report reads.
During analysis, they tried to reproduce the attack using different agents and succeeded on both OpenAI Codex and Claude Code. The bad news is that this is not a bug, and there’s nothing for the companies to patch.
AI Agents are designed to follow the AGENTS.md file to the letter, “the same way a browser that renders a phishing page is working as designed.” Instead, the problem becomes the fact that the AI agent can read the folder to which the browser can write files easily. “The vector stays open,” they say. “Defenses built around a human break when an agent takes the human’s place”.
In this case, the attackers tried to get the AI agent to install a malicious npm package called ‘function-color’. Apparently, this is a piece of malware built two years ago during a separate malicious campaign, but managed to fly under the radar until now. This also means that AI agents can be tricked into downloading pretty much anything from the internet, including ransomware, infostealers, and remote monitoring and management (RMM) tools.
Prompt injection with a spin
In essence, this is just a spin on the old prompt injection attack. To defend against it, users should treat ~/Downloads as “hostile ground for agents,” the researchers said. They should not start Codex, Claude Code, or any agent, in that folder, since that is where the web can plant a file in. Other than that, users should look for instruction files they didn’t write, especially in the Downloads folder or a cloned repository. “Read it before you let an agent near it.”
Finally, users should check their agent’s own config for unexpected blocks or changed commands. In a project’s .claude/settings.json, users should look for an ANTHROPIC_BASE_URL, a proxy, or any other API endpoint they did not set themselves.
“Keep the brakes on. Leave approval gates and sandboxes enabled. Be very suspicious of anything that tells the agent to bypass them If you find one, rotate. Assume the token leaked. A stolen token is a live session, not just one caught request,” Forever concluded.
AI agents might not be malicious by default, but they are definitely gullible, and so far, that’s turning out to be a major security liability.
Via BleepingComputer
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.
