Rogue AGENTS.md file tricks AI agents into running malware

Researchers at Forever Security say a malicious AGENTS.md file in a customer’s Downloads folder tricked an AI agent into attempting to deploy malware and steal session tokens. They say they stopped the attack before it caused meaningful damage.

The file looked like ordinary engineering notes. The researchers could not determine how it reached the folder, but suspect a browser downloaded it from a website that may have been compromised. Their report says websites can download some file types without a click or permission, while Markdown files are not usually treated as dangerous. An AI agent may follow instructions in an AGENTS.md file regardless of where it came from.

Forever Security says it reproduced the attack with OpenAI Codex and Claude Code. The attempted payload included a malicious npm package named function-color, which the researchers say was created two years earlier in a separate campaign. They describe the issue as a prompt-injection technique involving an agent’s access to files a browser can write.

The researchers advise treating the Downloads folder as hostile to agents, checking unfamiliar instruction files before use, and reviewing agent configuration for unexpected API endpoints or command changes. They also urge keeping approval gates and sandboxes enabled. These are recommendations from Forever Security, not reported fixes from the software makers.