Malicious AGENTS.md Files Can Hijack AI Coding Agents Launched From Downloads
Summary
Forever Security researchers say a malicious instruction file in a customer’s Downloads folder led an AI coding agent to attempt installing a rogue npm package. Their tests also demonstrated credential theft and code execution techniques against Codex and Claude Code.
Key points
- Researchers traced an agent’s attempt to install the malicious npm package function-color to an AGENTS.md file in the customer’s Downloads folder, which was also the agent’s working directory.
- The researchers say agents load applicable instruction files from their working directory, where malicious instructions can prompt actions using the agent’s available tools and permissions.
- A proof of concept demonstrated that a webpage could download an AGENTS.md file into Downloads; BleepingComputer verified the download using harmless file contents.
- In tests using a harmless payload that opened the calculator app, the researchers reported a 90% success rate against OpenAI Codex.
- In separate tests, a malicious CLAUDE.md file redirected Claude Code API traffic to a researcher-controlled server, exposing an OAuth token and enabling code-executing tool calls in roughly 50% of tests.
- The researchers could not determine how the original malicious file reached the customer’s Downloads folder. The attack required launching an AI agent in that same directory.
- Recommendations include using a narrowly scoped project directory, reviewing unfamiliar agent instruction files, and keeping approval prompts and sandbox protections enabled.
Article Details
- Event Type
- Researchers disclosed an attack in which a malicious AGENTS.md file in a Downloads folder manipulates AI coding agents.
- Impact
- Researchers demonstrated that malicious instruction files could lead OpenAI Codex to install a rogue npm package or execute code, and could redirect Claude Code API traffic to expose an OAuth token and enable account impersonation. Their reconstructed Codex test using a harmless payload succeeded in 90% of trials; the Claude Code test resulted in code-executing tool calls in roughly 50% of trials. Forever Security said the behavior follows the agents’ intended design, rather than identifying a software flaw requiring a vendor patch.
MITRE ATT&CK
People
Vendors
Anthropic"There is nothing here for OpenAI or Anthropic to patch.Forever SecurityResearchers at Forever Security, a company that monitors for risks introduced by AI agents and autonomous software, discovered the tactic on a customer’s computer, where a coding agent attempted to install the maliciousOpenAIThey reproduced the attack against OpenAI Codex and demonstrated a related technique against Claude Code to leak OAuth tokens and hijack the account using only the malicious instructions.
Products
Claude CodeThey reproduced the attack against OpenAI Codex and demonstrated a related technique against Claude Code to leak OAuth tokens and hijack the account using only the malicious instructions.Cursor CLIWeizman says that internal statistics show that hundreds of customers run AI agents, including Claude Code, OpenAI Codex, and Cursor CLI, from their ~/Downloads folders.OpenAI CodexThey reproduced the attack against OpenAI Codex and demonstrated a related technique against Claude Code to leak OAuth tokens and hijack the account using only the malicious instructions.