Researchers have detailed an attack that uses a malicious markdown file to trick AI coding agents into installing malware and stealing account credentials.
The file, named 'AGENTS.md,' was found by researchers at Forever Security in a customer’s Downloads folder. It contained instructions that caused an AI coding agent to attempt to install a malicious npm package called ‘function-color.’
The attack works because AI coding tools automatically read instruction files in their working directories. The files normally explain how to run tests, use tools, and follow coding rules. However, attackers can hide malicious commands inside them, causing an agent to carry out dangerous actions using its existing permissions.
Researchers reproduced the attack against OpenAI Codex using a benign test payload that opened the calculator app. The test succeeded in 90% of attempts.
They also demonstrated a related attack against Claude Code using a malicious CLAUDE.md file. The file redirected API traffic to a server controlled by the researchers, exposing an OAuth token. This could allow an attacker to impersonate the AI service and send commands that execute code. The technique succeeded in roughly 50% of tests.
The researchers warned that a malicious instruction file could potentially reach a Downloads folder through a website download. If a user then starts an AI coding agent in that folder, the agent may read and follow the malicious instructions.