How does the AGENTS.md malware attack function?
The attack relies on a sophisticated variation of prompt injection where a simple markdown (.md) file acts as a set of malicious instructions for an AI agent. Instead of a user typing a command, the agent reads a file that has been surreptitiously placed in its environment. Because AI agents are designed to follow instructions within specific configuration or instruction files to the letter, they treat the contents of an AGENTS.md file as legitimate commands.
The exploit leverages three specific environmental factors identified by Forever Security:
- The ability of websites to download certain file formats into a user's Downloads folder without explicit interaction or permission.
- The fact that markdown files are generally viewed as benign text documents rather than executable code by standard security software.
- The inherent design of AI agents to parse and act upon instruction files like AGENTS.md to understand their operational context.
By combining these factors, a threat actor can use a compromised website to drop a file into a directory that the agent is likely to scan. Once the agent processes the file, it is effectively hijacked, transforming from a helpful assistant into a rogue entity capable of executing the attacker's orders.
What was the impact of the observed real-world attack?
Forever Security reported catching a live instance of this attack on a customer's machine, where an AGENTS.md file was found disguised as ordinary engineering notes within the ~/Downloads folder. The file contained instructions that ordered the AI agent to deploy malware and exfiltrate session tokens, which could have granted attackers full access to the user's environment.
The use of the 'function-color' malicious package
During the investigation, researchers noted that the attackers attempted to use the agent to install a malicious npm package known as 'function-color'. This specific package was part of a separate malicious campaign that originated approximately two years ago but has managed to remain undetected by many traditional security layers. This highlights a significant risk: AI agents can be tricked into downloading a wide spectrum of internet-based threats, including infostealers, ransomware, and remote monitoring and management (RMM) tools, simply by following the instructions hidden in the markdown file.
Can this vulnerability be patched by AI developers?
Current research suggests that this is not a software bug in the traditional sense, meaning there is no immediate patch available for companies like OpenAI or Anthropic. The vulnerability exists because the agents are performing exactly as they were designed to: reading and following instruction files to improve their utility and context awareness.
During testing, researchers successfully reproduced the attack using two major AI coding tools: OpenAI Codex and Claude Code. The core issue is the intersection of browser behavior and agent behavior. While a browser is designed to render phishing pages or download files, an AI agent is designed to read the files those browsers download. As the Forever Security report states, "Defenses built around a human break when an agent takes the human's place." Because the agent can access the same directories that a web browser can write to easily, the attack vector remains open as long as agents are permitted to scan untrusted directories.
How can users protect their AI agents from hijacking?
Defending against this type of prompt injection requires a shift in how users treat local directories and agent configurations. Since the threat comes from the environment rather than a flaw in the AI model itself, the responsibility for mitigation falls largely on the user and their operational workflows.
The primary recommendation is to treat the ~/Downloads folder as "hostile ground" for AI agents. Users should avoid launching or running agents like Codex or Claude Code while their working directory is set to the Downloads folder, as this is the primary entry point for unverified files from the web. Additionally, users must adopt a policy of strict scrutiny for any instruction files that they did not personally create, particularly those found in cloned repositories or download folders.
Essential security checklist for AI agent users
To maintain a secure environment, users should implement the following technical safeguards:
- Verify instruction files: Always read the contents of .md or .json configuration files before allowing an agent to process them.
- Audit agent configurations: Check files like .claude/settings.json for unexpected changes, such as new ANTHROPIC_BASE_URL entries or unauthorized proxies.
- Maintain approval gates: Keep sandboxing and human-in-the-loop approval gates enabled. If an agent attempts to bypass these, it should be considered a high-risk event.
- Assume compromise: If you detect an unauthorized command or an unexpected API endpoint, rotate your session tokens immediately. A stolen token represents a live, active session.
Frequently asked questions
What is an AGENTS.md file?
An AGENTS.md file is a markdown document intended to provide context and instructions to an AI agent. In this specific attack vector, hackers use the file to hide malicious prompt injection commands that trick the agent into performing unauthorized actions, such as downloading malware or stealing data.
Why is markdown considered a threat in this context?
Markdown is considered a threat because it is a plain-text format that is rarely flagged by antivirus software as dangerous. Because AI agents are programmed to interpret markdown as a set of instructions, a malicious file can effectively act as a "new executable" without triggering standard security warnings.
Does this affect all AI agents?
The vulnerability is architectural rather than model-specific, meaning it can affect any agent that is designed to read local instruction files. Researchers have already proven the attack works on both OpenAI Codex and Claude Code, suggesting a broad risk across the industry.
How does a stolen token impact security?
A stolen token is extremely dangerous because it provides an attacker with a live, active session. Rather than just capturing a single request, the attacker can use the token to impersonate the user and perform various actions within the authenticated environment until the token expires or is revoked.
What should I do if my agent behaves strangely?
If an agent attempts to bypass sandboxes, access unauthorized URLs, or execute unexpected commands, you should immediately stop the session. Rotate all sensitive tokens, check your configuration files for unauthorized changes, and assume that your current session has been compromised by an attacker.
Key takeaways
- Malicious AGENTS.md files can hijack AI agents via prompt injection.
- The Downloads folder is a high-risk area because browsers can write to it without permission.
- The attack has been successfully demonstrated on OpenAI Codex and Claude Code.
- Users should treat the Downloads folder as hostile and avoid running agents there.
- Stolen session tokens allow attackers to maintain active, unauthorized access.
Conclusion
The emergence of the AGENTS.md exploit marks a significant shift in the threat landscape for artificial intelligence. By weaponizing the very files intended to make agents more capable, attackers have found a way to bypass traditional security assumptions. As AI agents move from experimental tools to integrated components of professional workflows, the distinction between benign text and malicious instructions becomes increasingly blurred. Maintaining security requires a proactive approach: treating agent environments as potentially hostile, enforcing strict human oversight, and treating any unexpected configuration change as a definitive sign of compromise.
