Malicious AGENTS.md files exploit AI coding agents

Security researchers from Forever Security have demonstrated a new vulnerability where malicious text files, specifically named AGENTS.md, can trick AI coding agents into executing harmful commands. The attack exploits the way agents interpret local instruction files within their working directory as legitimate guidelines.

By placing a deceptive AGENTS.md file in a user's Downloads folder—which web browsers often populate without explicit user consent—attackers can compromise agents like Codex and Claude Code. In one scenario, the file instructs the agent to install a known malicious npm package. In another, it manipulates configuration files to redirect API endpoints, allowing attackers to intercept OAuth tokens and bypass sandbox protections.

Researchers noted that while this resembles social engineering, it specifically targets the logic of autonomous agents. The success rate for the Codex exploit was reported to be over 90 percent in isolated testing environments. Because the agents are simply following instructions found in their active workspace, researchers state there is no specific CVE or patch available to fix the underlying logic of how these tools process local files.