In-the-wild attack plants malicious AGENTS.md file to hijack AI coding agents

A new indirect prompt injection technique uses a planted markdown instruction file to make AI coding agents install malware and expose credentials, and security firm Forever Security disclosed on October 26, 2026 that it had caught the attack running on a real customer machine. A new indirect prompt injection attack relies on using markdown files in an end user's downloads folder to install malware and steal credentials.

What happened

Forever Security found a malicious plaintext file named AGENTS.md in a customer's downloads folder, disguised as engineering notes.

This file type is a markdown file, used to guide agent behavior, and is trusted by many AI coding agents like OpenAI's Codex or Claude Code.

According to the research blog post, when an attacker plants a malicious file in a user's download folder, the user's agent may treat the file as trusted instructions and execute actions based on it.

According to Forever, the malicious instructions can persuade the agent to modify its configuration and perform follow-on actions.

If the agent does ingest one of these malicious markdowns, the planted file makes the agent rewrite its own configuration, opening itself up for an attacker to instruct it to install malware or share its own login tokens.

In testing, Forever said the Codex attack chain succeeded more than 90% of the time, while for Claude Code the researchers reported roughly a 50% success rate, though certain variables may have influenced this success rate.

The attack requires someone only to grant their coding agent access to their home directory downloads folder, and that the agent can interact with web content.

Forever says that according to its telemetry, about half of its customers run a coding agent inside their downloads folder, and a quarter of agent sessions open a real browser.

Impact

In the case Forever observed, the exploit worked but was then blocked from follow-on activity by Forever's real-time security product, preventing an NPM package from being installed.

Forever only managed to discover the initial example of the attack in the wild, though Weizman says the company is actively searching for more attempts.

Response

Forever's researchers wrote that it caught live malware on a real customer's machine, attempting a new kind of attack the industry had not documented — and stopped it cold, before any code ran.

Forever said there is nothing here for OpenAI or Anthropic to patch, and that the problem is the circumstances: a folder the web can write to, trusted as if the user filled it.

Lead researcher Weizman told Dark Reading that AI firms like OpenAI and Anthropic may consider making agents aware of the risk of following commands originated by files that can be dropped by websites, while adding that the issue described by the research is mostly beyond their security model.

Lessons for security leaders

Forever recommends treating the user's home-directory download location (~/Downloads) as hostile ground for agents.

Users can also check for instruction files they did not write, examine agent configurations for unexpected changes, and leave approval gates and sandboxes enabled.

If a red flag has been found, the researchers said organizations should assume login tokens are compromised and to rotate credentials.

Forever described the case as one early example of a bigger pattern: defenses built around a human break when an agent takes the human's place.