Live Feeds
● LIVE Updated 1h ago · 14 sources tracked

AI coding agents hijacked using AGENTS.md file in Downloads folder

Security researchers discovered a supply-chain attack vector where a malicious text file placed in a user's Downloads folder hijacks AI coding agents such as OpenAI Codex and Claude Code. The plain-text instruction file, disguised as ordinary engineering notes, tricks the automated assistant into running malware or installing a rogue npm package. Forever Security caught the attempt on a real customer machine and stopped the agent before code execution occurred. Related testing demonstrated that attackers can also manipulate coding agents into leaking OAuth tokens and hijacking user accounts.

🎙️

Listen to Live Briefing

Real-time synthesized voice briefing · Live Feeds Desk

⏱ ~3 min
Speed:
RSS Source map (14)
⚡ Key Developments & Real-Time Context
Text size:
  • ✓ Security firm Forever Security found a malicious AGENTS markdown instruction file in a customer Downloads folder that tricked an AI coding agent into installing a rogue npm package.
  • ✓ Forever Security caught the attempt on a real customer machine and stopped the agent before any code ran.
  • ✓ The AGENTS.md file is a plain-text instructions file that a coding agent reads when it starts in a folder and follows as directions.
  • ✓ The malicious file instructed the agent to add a server to its own configuration and install an npm package called function-color.
🛡️ Source Corroboration: 14 independent reporting domains (100% confidence) ⏱ Read time: ~3 min

What changed

Security firms published findings detailing how planted markdown files in download directories can successfully subvert automated coding assistants.

Live updates

  1. AI Coding Agents Hijacked via Planted AGENTS.md Files

    Security researchers discovered a supply-chain attack vector where a malicious text file placed in a user's Downloads folder hijacks AI coding agents such as OpenAI Codex and Claude Code. The plain-text instruction file, disguised as ordinary engineering notes, tricks the automated assistant into running malware or installing a rogue npm package. Forever Security caught the attempt on a real customer machine and stopped the agent before code execution occurred. Related testing demonstrated that attackers can also manipulate coding agents into leaking OAuth tokens and hijacking user accounts.

    Why it matters

    AI coding assistants automatically read configuration and instruction files when starting up in a directory. Attackers exploit this behavior by dropping malicious markdown files onto user systems via drive-by downloads or browser exploits. This bypasses traditional software safeguards by turning the user's own trusted AI tools against them.

    What is confirmed

    • Security firm Forever Security found a malicious AGENTS markdown instruction file in a customer Downloads folder that tricked an AI coding agent into installing a rogue npm package.
    • Forever Security caught the attempt on a real customer machine and stopped the agent before any code ran.
    • The AGENTS.md file is a plain-text instructions file that a coding agent reads when it starts in a folder and follows as directions.
    • The malicious file instructed the agent to add a server to its own configuration and install an npm package called function-color.
    • Researchers reproduced the attack against OpenAI Codex and demonstrated a related technique against Claude Code to leak OAuth tokens and hijack accounts.

    Still unconfirmed

    • Attackers may have delivered the file to the customer machine through automated browser downloads or drive-by web exposure, though the exact entry method remains undetermined.

    What to watch next

    • Additional disclosures from security vendors regarding the vector used to place AGENTS.md files into user download folders.
    • Updates from OpenAI and Anthropic regarding mitigations for instruction-following vulnerabilities in coding assistants.
    Sources used for this update (16)
    1. www.bleepingcomputer.com — Retail giant Ahold Delhaize takes systems offline after cyberattack - BleepingComputer
    2. BleepingComputer — AI coding agents hijacked using AGENTS.md file in Downloads folder
    3. The Hacker News — Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware
    4. Mashable — Hackers target AI coding agents with malicious text files
    5. NeoTeo — AGENTS.md attack: What the reported incident shows
    6. Yahoo Tech — Hackers find a way to turn users' own AI agents and Downloads folders against them
    7. Martin Cid Magazine — Claude Code and Codex obey a file any website can drop in your Downloads
    8. www.bleepingcomputer.com — AI coding agents hijacked using AGENTS.md file in Downloads folder - BleepingComputer
    9. dev.to — How a Downloads Folder File Can Hijack Your AI Coding Agent - DEV Community
    10. www.martincid.com — Claude Code and Codex obey a file any website can drop in your Downloads – Martin Cid Magazine
    11. securityarsenal.com — AI Coding Agents Hijacked via Malicious AGENTS.md File ...
    12. www.linux.org.hk — Hong Kong Linux User Group - 香港Linux用家協會(HKLUG) > Archive > One planted AGENTS.md file was all it took to hijack an AI....
    confidence 100%
📊

Community Sentiment: How do you assess this situation?

Voice your perspective · Real-time aggregated sentiment from the Live Feeds community