Malicious AGENTS.md Files Used to Hijack AI Coding Assistants
Researchers discovered a new attack vector where malicious markdown files in local directories trick AI coding agents into installing harmful packages and compromising credentials.
A malicious AGENTS.md file in a customer's Downloads folder attempted to force an AI coding agent to install a known-malicious npm package called function-color. Forever Security discovered the file on a real machine and stopped the agent before execution, though the origin of the file remains unknown.
AGENTS.md files are plain-text markdown used to supply project instructions like tools and test procedures to agents such as OpenAI's Codex, which load them automatically from the working directory. The incident file disguised itself as standard engineering notes.
The instructions directed the agent to add a server to its configuration and install function-color. This package is part of the MALFEX malware campaign previously analyzed by CloudSEK and Checkmarx. It uses a downloader named function-flag to fetch and execute a Windows payload. Forever Security reproduced the attack against Codex and demonstrated a related technique against Claude Code that leaked OAuth tokens and hijacked the account.
Two normal behaviors enable the attack path. Agents trust instructions in open folders, and web pages can silently save files with specific names and contents to the Downloads folder. While an AGENTS.md file is not executable, its plain-text directives can cause agents to run commands, alter settings, or install packages using their assigned permissions and tools.