AI coding agents hijacked using AGENTS.md file in Downloads folder

A new security vulnerability has emerged where AI coding agents can be hijacked through the use of a specific text file named AGENTS.md. According to reports from BleepingComputer and The Hacker News, this malicious file is placed within a user's Downloads folder. Once present, the file attempts to trick the AI coding agent into performing unauthorized actions, specifically attempting to install malware on the affected system. This method essentially turns a user's own AI tools and their local storage folders against them. Coverage from multiple outlets, including Yahoo Tech and Mashable, emphasizes that hackers are targeting these AI coding agents with malicious text files.

Martin Cid Magazine specifically identifies Claude Code and Codex as agents that obey files that any website can drop into the Downloads folder. NeoTeo provides analysis on the reported incident, labeling it the AGENTS.md attack. These sources collectively highlight a critical gap in how AI agents interact with local file directories and the permissions they are granted when scanning for instructions. The context of this trend involves the growing integration of autonomous AI coding agents into developer workflows. Because these agents are designed to read project files and follow instructions to automate coding tasks, they may inadvertently process instructions from an AGENTS.md file if it is located in a directory the agent accesses.

The risk is magnified because, as Martin Cid Magazine notes, websites can drop files into the Downloads folder, providing a delivery mechanism for the malicious instructions that lead to the attempted installation of malware. Looking ahead, the focus remains on how AI coding agents like Claude Code and Codex handle external files. The reported incidents show that the mere presence of a specifically named file in a common directory can lead to a hijacking attempt. Future developments will likely center on whether these agents can be patched to ignore unauthorized instruction files in the Downloads folder. Coverage does not yet specify if a formal patch has been deployed or if users must manually clear their folders to mitigate the risk.