Security firm says malicious AGENTS.md files can hijack AI coding agents
Security firm Forever Security reported that malicious AGENTS.md files placed in download folders can hijack AI coding agents, causing them to deploy malware and steal tokens. The attack was reproduced on OpenAI Codex and Claude Code and is considered a design feature rather than a bug.
Security firm Forever Security reported that researchers have discovered a new attack vector exploiting the default behavior of AI coding agents such as OpenAI Codex and Anthropic Claude Code. Attackers need only place a malicious AGENTS.md file, disguised as ordinary engineering notes, in a user's "Downloads" folder to hijack the agent and trigger dangerous operations.
According to TechRadar, Forever Security claimed to have caught this activity on a real customer's machine. The malicious file instructed the AI agent to deploy a malicious npm package named function-color and exfiltrate session tokens. Because modern AI agents are designed to strictly follow instructions in AGENTS.md, and browsers can write files to the downloads folder without user clicks or permission, this creates a persistently open attack surface.
Researchers emphasized that this is not a software bug fixable with a patch, but the result of agents working as designed—similar to how a browser renders a phishing page. Current defense recommendations include treating ~/Downloads as hostile ground for agents, avoiding starting agents in that directory, and carefully inspecting any instruction files not written by the user before allowing agent access.