Researchers showed AI agents can be hijacked through malicious AGENTS. md files placed in common download locations
The attack abuses prompt-injection behavior, potentially triggering malware downloads or token theft
Defenders are urged to treat Downloads folders as untrusted and inspect agent instruction files carefully
An AI agent was tricked into going rogue with nothing more than a simple markdown (. MD) file, with researchers warning this file format is the new malicious executable. With just a basic . MD file and access to a website, threat actors can get people’s agents to execute malicious code or share access tokens. Researchers Forever Security claim to have seen the attack play out in the wild, but stopped it before it was able to do any meaningful damage. To pull it off, the attackers took advantage of a couple of things: 1) the fact that websites can download some file formats without user’s knowledge or consent; 2) the fact that . md files are not seen as malicious or dangerous by default; 3) the fact that AI agents will act on anything that’s written in the AGENTS. md file, regardless of what it’s inside. In its report, Forever Security said it caught live malware on a real customer’s machine – an AGENTS. md file in the ~/Downloads folder. The document, disguised as ordinary engineering notes, was everything but ordinary – it turned the AI agent rogue, ordering it to deploy malware and exfiltrate session tokens. Working on Codex and Claude Code
The researchers could not determine how the file made it to the Downloads folder and are assuming a browser picked it up from a website that was likely compromised in advance. “Downloads is the one folder a website can drop a file into with no click and no permission. Together, that lets the web plant orders your own agent carries out. Markdown is the new executable,” the report reads. During analysis, they tried to reproduce the attack using different agents and succeeded on both OpenAI Codex and Claude Code…