Malicious AGENTS.md Files Targeted to Compromise AI Coding Agents
Researchers discovered a new attack vector using AGENTS.md files to trick AI coding tools like Codex and Claude Code into executing malicious instructions.
Forever Security detected a malicious AGENTS.md file on a customer's machine, marking what researchers Gal Weizman and Omer Samet claim is the first in-the-wild case of using such a file to target AI coding agents. Disguised as engineering notes in a downloads folder, the file attempted to make coding agents treat planted markdown as trusted instructions.
OpenAI's Codex and Claude Code read dot-md instruction files as project context. When an agent launches in a directory holding a planted file, injected instructions can force the agent to rewrite its configuration, install malware, or hand over login tokens, provided the agent has access to the downloads folder and web content.
Forever's real-time security product blocked the follow-on NPM package installation step, preventing code from running, and researchers report finding only this single instance so far while searching for more.
During reproduction testing against Codex and Claude Code, the Codex attack chain succeeded over 90% of the time, while Claude Code succeeded roughly 50% of the time. Researchers state this is not a parser bug because the agent follows instructions as built, similar to a browser rendering a phishing page, leaving the vector open since the web can write to the folder. Other tools reading similar files include CLAUDE.md, .cursorrules, and Copilot instruction files, with variants hiding payloads in HTML comments or invisible Unicode characters.
Defenders should treat the downloads folder as hostile ground, check for unwritten instruction files, verify agent configurations, keep approval gates and sandboxes enabled, and rotate credentials if red flags appear.