Forever Security Reports In-the-Wild Attack Targeting AI Coding Agents

Summary

Forever Security says a malicious AGENTS.md file in a customer’s Downloads folder attempted to manipulate an AI coding agent into changing its configuration and installing malware or exposing tokens. Its product blocked follow-on activity.

Key points

Forever Security reported finding a malicious AGENTS.md file disguised as engineering notes in a customer’s Downloads folder; researchers could not determine how it arrived.
When an AI coding agent is launched in that directory, it may read the file as project instructions and change its configuration.
The researchers said the altered agent could then be instructed to install malware or share login tokens.
Forever reported the attack succeeded in testing more than 90% of the time with Codex and roughly 50% with Claude Code; the researchers noted variables may have affected the latter rate.
In the observed case, Forever’s security product reportedly blocked follow-on activity, preventing an NPM package from being installed; the article does not report that code ran.
Forever recommends treating Downloads as untrusted for agents, checking for unfamiliar instruction files and configuration changes, keeping approval gates and sandboxes enabled, and rotating credentials if a red flag is found.

Article Details

Event Type: In-the-wild indirect prompt injection attack using a malicious Markdown instruction file to manipulate AI coding agents.
Impact: Forever Security reported finding the attack on a customer’s machine. The attack chain reportedly worked, but Forever’s real-time security product blocked follow-on activity before an NPM package was installed. The article does not report confirmed malware installation or credential theft; login tokens were identified as potentially at risk.

People

Gal WeizmanLead researcher at Forever Security; discussed the in-the-wild attack and the company’s findings.Omer SametCo-wrote Forever Security’s research post describing the attack.

Vendors

Anthropic"There is nothing here for OpenAI or Anthropic to patch. An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do, the same way a browser that renders a phishing page is working as Forever SecurityThat's according to Forever Security, which recently detailed a novel AI agent attack they captured in the wild. According to a research blog post, when an attacker plants a malicious file in a user's download folder,OpenAI".md" is a markdown file, used to guide agent behavior, and is trusted by many AI coding agents like OpenAI's Codex or Claude Code — Forever reproduced the attack with both (the original variant targeted Codex

Products

Claude Codefile, used to guide agent behavior, and is trusted by many AI coding agents like OpenAI's Codex or Claude Code — Forever reproduced the attack with both (the original variant targeted Codex specifically).Codexis a markdown file, used to guide agent behavior, and is trusted by many AI coding agents like OpenAI's Codex or Claude Code — Forever reproduced the attack with both (the original variant targeted Codex