Malicious AGENTS.md tried to hijack coding agents
Original title: In-the-Wild Attack Abuses AI Agents' Trust in Markdown
Forever Security says a planted markdown file on a customer PC could push Codex to install malware or leak tokens, and was stopped before code ran.
Forever Security found a malicious AGENTS.md, disguised as engineering notes, in a customer's downloads folder. Coding agents that trust local markdown, including OpenAI's Codex and Claude Code, can read that file as project instructions, rewrite their configuration, and then install malware or share login tokens. The original sample targeted Codex. Researchers do not know how the file arrived; they note a malicious website could try to download it. The firm says it stopped the attempt before any code ran.
Unconfirmed: Researchers could not determine how the AGENTS.md file reached the customer's computer.
- The planted file was plaintext markdown named AGENTS.md.
- Forever reproduced the behavior with both Codex and Claude Code.
- The original variant specifically targeted OpenAI's Codex.
- A malicious website download is one delivery path the researchers noted.
Impact: Agent may install malware or expose login tokens
| Product | Affected |
|---|---|
| OpenAI Codex | — |
| Claude Code | — |
- 1.Do not launch coding agents in folders holding untrusted markdown instruction files.
- 2.Review AGENTS.md and similar local instruction files before an agent reads them.
- ATT&CK
- T1204.002 Malicious File
- Vendors
- OpenAI
- Products
- CodexClaude Code
- Organizations
- Forever Security
From the original article
7 min read at darkreading.com
A new AI agent prompt injection technique exploits how coding assistants consume local instruction files, blurring the line between text documents and executable actions.
By Alexander Culafi · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.