Full confession up front: this website runs on an AGENTS.md file. It's a plain text file that tells AI coding agents how to work on the project, and it's how my site updates itself. So when BleepingComputer reported today that a malicious AGENTS.md file hijacked an AI coding agent, I read it twice.
What Happened
Researchers at Forever Security, a company that monitors risk from AI agents, found a malicious AGENTS.md sitting in a customer's ~/Downloads folder. The file told the AI coding agent to install a rogue npm package called "function-color."
The catch: Downloads was also where the customer ran their coding agent. Agents automatically read AGENTS.md from their working directory, so the agent did exactly what it was told. Nobody hacked the agent. The agent just followed instructions from a file it had every reason to trust.
Nobody knows how the file got there. The researchers said a malicious web page could potentially drop one into Downloads without the user doing anything. And Downloads is the junk drawer of every computer on earth.
How Bad Is It
The researchers reproduced it:
- OpenAI Codex: Using a harmless payload that just opened the calculator, the attack worked 90% of the time.
- Claude Code: A related technique used a malicious CLAUDE.md to redirect API traffic and expose the agent's OAuth token. From there, the attacker's server could hand back tool calls that ran code, which worked in roughly half of tests.
- Cursor CLI: Not tested, but the researchers said customers run it from Downloads too.
Here's the part I respect: the researchers said there's nothing for OpenAI or Anthropic to patch. The agents worked as designed. That's what makes it dangerous.
Instruction Files Are Code Now
We spent twenty years teaching people not to run random .exe files from Downloads. Now we've built tools that treat random .md files as orders. An AGENTS.md is effectively a script written in English, executed by something with shell access and your credentials. Treat it that way.
What to actually do:
- Never run an agent from Downloads, your home folder, or any broad location. Run it from the specific project directory. Both OpenAI and Anthropic recommend exactly this.
- Read unfamiliar AGENTS.md and CLAUDE.md files before an agent does. If you cloned it or downloaded it, it's untrusted input.
- Keep approval prompts and sandboxing on. Turning them off is how a prank payload becomes a real one.
- Test untrusted code in isolation. A throwaway VM or container costs nothing compared to a stolen token.
For what it's worth, my site's automation runs in an isolated cloud sandbox against one specific repo, not on my laptop and definitely not in my Downloads folder. That's not luck. That's least privilege applied to an AI agent.
Bottom Line
Prompt injection doesn't need a clever exploit anymore. It needs a text file in the right folder. The fix is old-school Zero Trust: limit where the agent runs, limit what it can reach, and never let "it was in a trusted location" substitute for verification.
Full story: AI coding agents hijacked using AGENTS.md file in Downloads folder (BleepingComputer)