As reported by BleepingComputer, researchers at Forever Security discovered a malicious AGENTS.md file in a customer's Downloads folder that instructed an AI coding agent to install a rogue npm package. The researchers reproduced the attack against OpenAI Codex and demonstrated a related technique against Claude Code to exfiltrate OAuth tokens — all through plain-text markdown instructions that the agents are designed to automatically trust and follow.
This is not a vulnerability in the traditional sense. There is no CVE to patch, no buffer overflow to fix, no authentication bypass to close. An AI coding agent that reads AGENTS.md from its working directory and follows those instructions is operating exactly as designed. That is precisely what makes this so dangerous — the attack surface is emergent from intended functionality, not a software defect.
Why This Matters More Than a Typical CVE
Traditional vulnerability management relies on a clear boundary: something is broken, a vendor fixes it, defenders apply the patch. The AGENTS.md attack vector collapses that model. The researchers correctly note that "there is nothing here for OpenAI or Anthropic to patch." The trust model itself — where an autonomous agent blindly follows instructions from any file in its working directory — is the vulnerability. This shifts the burden entirely to defenders and deployment architects.
The browser-to-Downloads delivery path makes this particularly insidious. Major browsers — Chrome, Edge, Firefox — default to saving files to ~/Downloads without prompting. A user merely visiting a malicious page can silently receive an AGENTS.md file. If that same user later runs an AI coding agent with ~/Downloads as the working directory — a not-uncommon scenario for quick tasks — the agent will dutifully read and execute whatever instructions the attacker planted.
Who Is at Risk
The Broader Implication: Prompt Injection Meets File Systems
This attack is a natural evolution of indirect prompt injection — but with a critical difference. Traditional prompt injection exploits user-controlled chat inputs or web content that an agent ingests at runtime. The AGENTS.md vector exploits persistent, file-system-resident instructions that agents load automatically and treat with elevated trust. The instruction file is not a conversation; it is a configuration artifact. Agents have no mechanism to distinguish between a developer-authored instruction file and an attacker-dropped one.
Forever Security's OAuth token exfiltration demonstration against Claude Code underscores the severity. When an agent can be instructed to read and transmit credential files, the attack moves from nuisance to full account takeover. An attacker who can plant a markdown file can potentially pivot to source code exfiltration, credential theft, and lateral movement within development environments.
Shield53 Recommendations
- Restrict working directories: Never run AI coding agents with
~/Downloadsor any browser-writable directory as the working context. Use dedicated, access-controlled project directories. - Implement instruction file allowlisting: Where possible, configure agents to only load instruction files from trusted paths or repositories with verified provenance.
- Monitor
AGENTS.mdand similar files: Deploy file integrity monitoring (FIM) on directories where AI agents operate. Alert on any new or modified instruction files, especially in user-writable locations. - Sandbox agent permissions: Run AI coding agents with least-privilege file access. Block read access to credential stores, SSH keys, OAuth tokens, and
.envfiles unless explicitly required and approved. - Constrain package installation: Use allowlisted package registries or require manual approval for any package installation initiated by an AI agent. Log and review all agent-initiated
npm install,pip install, or equivalent commands. - Browser hardening: Configure browsers to prompt for download location rather than auto-saving to
~/Downloads. Consider browser policies that restrict automatic downloads from untrusted sites. - Establish AI agent governance: Document which agents are approved, what directories they may operate in, what permissions they hold, and who is accountable for auditing their behavior. Treat AI agents as privileged service accounts, not developer conveniences.
The
AGENTS.mdattack is a warning that AI agent security cannot be outsourced to vendors alone. When the intended behavior IS the vulnerability, the only defense is architectural — restrictive permissions, monitored boundaries, and a zero-trust approach to every instruction an agent reads.
