Researchers at Forever Security have uncovered a novel security risk involving autonomous AI coding assistants, which can be hijacked through malicious markdown instruction files planted in local directories. According to industry reports, attackers leverage default browser behaviors to deposit rogue files into user download folders, tricking tools like OpenAI Codex and Claude Code into executing dangerous commands or exfiltrating sensitive tokens.
The Browser-to-Agent Attack Vector
The underlying vulnerability exploits the intersection of automated file handling and web browser design. While standard browsers such as Chrome, Edge, and Firefox often save files directly to the local download directory without prompting, alternative browsers like Brave may require explicit user approval for incoming files. Security analysts discovered that malicious websites can silently drop an instruction file named AGENTS.md or CLAUDE.md into this location. Because developers frequently launch AI agents directly inside their download folders to inspect files, the agents automatically parse these markdown documents as legitimate project instructions. Reports indicate that internal usage statistics show hundreds of users routinely running agents from broad parent directories, with specific tools logging thousands of sessions from the download location.
Real-World Incidents and Proof-of-Concept Results
Investigators first identified the threat in the wild on a customer machine, where an AI agent attempted to install a malicious npm package named function-color after reading a disguised markdown instruction file. To verify the broader threat landscape, researchers constructed proofs of concept and tested them against major agent frameworks. Testing against OpenAI Codex showed a high success rate in forcing the agent to execute auxiliary tasks, while tests targeting Claude Code demonstrated that altered instruction files could redirect API traffic to external servers, exposing OAuth tokens and enabling remote command execution in roughly half of the test runs. Because AI agents are fundamentally built to follow instructions written in markdown files to the letter, software vendors maintain that this behavior is working as intended rather than a patchable software bug.
Rethinking Agent Security Boundaries in Development Environments
This security discovery underscores a fundamental paradigm shift in modern cybersecurity: traditional defensive models designed around human users break down entirely when autonomous agents take over local execution and filesystem access. While software developers design AI coding assistants to parse local configuration and documentation files seamlessly, the practice of executing tools from broad, untrusted directories introduces profound risks. The reports emphasize that the security onus falls heavily on users to change operational habits and establish strict folder boundaries. Industry experts recommend strictly isolating agent working directories to specific, dedicated project folders rather than broad parent directories or the home download folder. Furthermore, maintaining strict sandboxing, reviewing unfamiliar instruction files before execution, and inspecting configuration files for unauthorized proxy settings or custom API endpoints are critical mitigation steps. Ultimately, as AI agents become more deeply integrated into everyday engineering workflows, securing the boundary between passive web storage and active agent execution remains an urgent challenge for development teams worldwide.
Editorial graphic and headline text by Signal Titans.
Source: AI agents tricked by a rogue downloads file into running dangerous malware · AI coding agents hijacked using AGENTS.md file in Downloads folder
SIGNAL TITANS
Leave a Reply