Silent AI Hijacking: How Malicious Markdown Files Are Turning Coding Agents Against Their Users
Researchers at Forever Security have uncovered a sophisticated and largely silent attack vector that exploits the inherent design of modern AI coding agents by leveraging seemingly innocuous markdown files. By dropping a malicious AGENTS.md or CLAUDE.md file into a user’s Downloads folder, attackers can manipulate AI agents into executing unauthorized commands, installing rogue software, or exfiltrating sensitive credentials. This vulnerability arises not from a traditional software flaw, but from the functional synergy between browser download behaviors and the way AI agents interpret project-specific instructions.
The Mechanism of the Attack
AI coding agents are designed to be autonomous, context-aware assistants. To function effectively, they are built to parse local directory structures for instructions that define coding conventions, test suites, and preferred toolsets. Files like AGENTS.md—which are plain-text documents containing these instructions—are industry-standard tools used to guide an agent’s behavior within a specific project repository.
The security researchers discovered that because these files are treated as trusted configuration guides, they possess the power to dictate the agent’s actions. The threat emerges when an agent is launched within a directory containing a malicious version of these files. Because the Downloads folder is a common working directory for many developers—often used to quickly organize or inspect newly acquired files—it becomes a prime target for what security experts are calling "AI prompt injection through environment manipulation."
The attack chain begins when a user visits a compromised or malicious website. Through automated download triggers, a malicious AGENTS.md file is silently placed into the ~/Downloads directory. Because most modern browsers, including Google Chrome, Microsoft Edge, and Mozilla Firefox, allow files to be saved to the Downloads folder without explicit user intervention for every single item, the payload can be delivered without the victim’s knowledge. Once the file is present, the attack becomes active the moment the user launches an AI coding agent (such as Claude Code, OpenAI Codex, or the Cursor CLI) from that directory. The agent automatically scans its environment, identifies the markdown instructions, and begins to execute them, assuming they are legitimate developer directives.
Chronology and Proof-of-Concept
The investigation by Forever Security began following the discovery of a customer’s machine attempting to install a rogue npm package identified as "function-color." Upon further analysis, researchers traced the command to the contents of an AGENTS.md file stored in the user’s Downloads folder.
Following the initial discovery, the research team developed a proof-of-concept (PoC) to validate the feasibility of the exploit. In one controlled experiment, they successfully manipulated OpenAI Codex into launching the system’s calculator application, achieving a 90% success rate across multiple tests. This demonstrated that an agent would blindly follow instructions to execute system-level commands if those instructions were provided in the expected configuration format.
In a more critical second phase of testing, the team targeted Claude Code. By crafting a specific CLAUDE.md file, they were able to redirect the agent’s API traffic to a server under their control. This allowed them to intercept the agent’s OAuth tokens, effectively hijacking the user’s account and enabling the attacker to impersonate the model. This secondary attack was successful in approximately 50% of the trials, highlighting a significant risk to account integrity and data privacy.
Statistical Context and User Behavior
The scale of the risk is magnified by common developer habits. Data analyzed by Forever Security indicates that hundreds of users regularly run AI coding sessions directly from their ~/Downloads folders. According to internal metrics shared with investigators, the Claude Code agent alone recorded over 1,300 sessions initiated from the Downloads directory within a single observed window.
This behavior is often a result of convenience; developers frequently download archives, scripts, or documentation and open their coding agents to quickly inspect or organize those items. Because the agent requires a "working directory" to operate, the Downloads folder is often the path of least resistance. However, this convenience creates a broad, uncontrolled environment where web-originated files can interact with the privileged execution capabilities of an AI agent.
Industry Perspective and Security Implications
It is crucial to note that both OpenAI and Anthropic have confirmed that their respective agents are functioning exactly as intended. There is no software "bug" to patch in the traditional sense, as the agents are performing their primary function: following the project-specific instructions provided in their working directory.
"An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do," the researchers stated in their report. This places the burden of defense almost entirely on the user and the architectural best practices of AI implementation.
The incident highlights a fundamental shift in cybersecurity. As AI becomes more deeply integrated into the software development lifecycle, the attack surface is no longer limited to code vulnerabilities or network exploits. It now includes "instructional vulnerabilities," where the intelligence of the agent itself is weaponized against the user. Because the agent interprets these markdown files as authoritative, the line between legitimate project configuration and malicious code execution becomes dangerously thin.
Mitigation and Best Practices
Security experts and the AI developers themselves recommend a strict shift in how AI agents are initialized. The primary defense against this form of hijacking is the principle of least privilege regarding the working directory.
- Scoped Working Directories: Users should never launch AI coding agents from a root directory or a high-traffic folder like ~/Downloads or ~/Documents. Instead, agents should be restricted to isolated, project-specific folders that contain only trusted files.
- Directory Isolation: By ensuring the agent only has access to the specific codebase it is intended to modify, the risk of it loading a rogue configuration file from another source is significantly reduced.
- Instruction Review: Developers should treat AGENTS.md and CLAUDE.md files with the same scrutiny applied to third-party code. If an agent requests to install a new package or redirect traffic, users should verify the source of the configuration file.
- Environment Monitoring: Organizations should implement monitoring solutions that track the execution of AI agents and flag unusual activity, such as attempts to install packages or modify network settings that deviate from established project workflows.
- Browser Security: While browsers have become more transparent, users should ensure that automatic downloads are restricted and that notifications are enabled. Recognizing the "silent" download of a configuration file is the first step in preventing the agent from ever processing it.
The Broader Impact on AI Security
The implications of this research are far-reaching. As AI agents move from simple chatbots to autonomous workers capable of modifying files, running tests, and handling sensitive API keys, the potential for "indirect prompt injection" grows. This specific vulnerability is a preview of the challenges inherent in building autonomous systems that rely on ambient context—such as local files—to perform their tasks.
As the industry moves forward, it is likely that developers of AI coding agents will need to introduce "safe mode" features or prompt-based approval mechanisms for configuration changes. Until such features become industry standards, the onus remains on the user to maintain a clean and isolated environment for their AI assistants. The era of the "smart" agent has arrived, but so too has the era of "smart" threats that target the very instructions that make these agents so useful. Maintaining a rigorous, disciplined approach to where and how these agents are deployed is no longer just a best practice; it is a critical security imperative.
