Artificial Intelligence

AI Coding Agents Hijacked Via Malicious AGENTS.md Files

Security researchers have uncovered a new attack vector targeting AI coding agents by leveraging malicious instruction files planted quietly inside user download directories.

Radwan AbdulhadiEditor and technology writer

Published: October 25, 2026 · Updated: October 25, 2026 · 3 min read

AI Coding Agents Hijacked Via Malicious AGENTS.md Files — Image: BleepingComputer

Key points

A malicious AGENTS markdown instruction file found in a customer's Downloads folder tricked an AI coding agent into installing a rogue npm package.
Researchers at Forever Security reproduced the attack against OpenAI Codex and demonstrated a related technique against Claude Code.
Popular browsers like Chrome, Edge, and Firefox can silently drop files into the ~/Downloads directory from web pages without user interaction.
Because AI agents automatically load applicable configuration files from their working directory, malicious instructions can lead to unauthorized commands and credential theft.
Both OpenAI and Anthropic recommend running AI coding agents from specific project directories rather than broad parent directories like the home or downloads folder.

The Threat of Malicious AGENTS.md Files

Security analysts have identified a novel method where threat actors can hijack autonomous software by exploiting markdown configuration files. Specifically, researchers found a malicious AGENTS markdown instruction file in a customer's Downloads folder that tricked an AI coding agent into installing a rogue npm package called 'function-color.'

Markdown files such as AGENTS.md function as plain-text configuration documents containing project-specific parameters for AI coding agents. These files typically outline what tools to utilize, how to execute automated tests, and which coding standards to obey. However, because agents automatically scan and load files from their active working directory, embedding malicious commands can manipulate the software into executing shell commands, altering system settings, or downloading dangerous packages using its assigned permissions.

Silent Payload Delivery via Browser Downloads

Investigations by Forever Security revealed that the ~/Downloads directory presents a unique risk because it is a folder that the web can write to independently. As detailed in a security advisory, a web page can silently download a file named AGENTS.md straight into a user's local Downloads folder without requiring direct user validation or interaction.

While browsers like Brave prompt users to approve individual downloads, popular platforms including Chrome, Edge, and Firefox save web assets directly to the local ~/Downloads directory by default. They notify users via local desktop notifications rather than blocking the file write operation entirely, leaving an opening for dropped instruction files if a user fails to notice the alert.

Exploiting OpenAI Codex and Claude Code

The investigative team expanded their analysis beyond initial observations by conducting controlled simulations against prominent AI models. According to researchers say, the attack vector was successfully tested against OpenAI Codex and Claude Code to evaluate the potential for arbitrary code execution and credential leakage.

To demonstrate the delivery mechanism, experts designed a specialized proof-of-concept page. When tested, the PoC page successfully transferred an instruction file containing test strings into the target location.

In practical tests using Codex, a harmless payload intended to open the local calculator application succeeded 90% of the time when the agent was launched inside the infected directory. Furthermore, testing with a malicious CLAUDE.md file redirected Claude Code's API traffic to a controlled external server, exposing OAuth tokens and letting the server impersonate the model to execute arbitrary code in roughly half of the attempts.

Platform Behavior and Mitigation Advice

Security experts emphasize that this vulnerability stems from the intended and standard operation of both web browsers and coding agents rather than an exploitable software bug. There is nothing for platform developers to patch because an agent following local directory instructions is performing precisely the tasks it was built to handle.

To safeguard development environments, both OpenAI and Anthropic advise users to carefully manage their operational directory structures. Developers should avoid setting the general home directory or broad parent folders like ~/Downloads as the working space for autonomous coding agents.

Instead, operators should consistently launch AI agents from the strict root directory of the specific software project they intend to modify. Limiting the filesystem scope, keeping sandbox protections enabled, and auditing unfamiliar configuration files like AGENTS.md or CLAUDE.md before execution help minimize the risk of accidental compromise.