GoKawiilMalicious AGENTS.md files found tricking AI coding agents into running attacker commands
Forever Security researchers discovered a malicious AGENTS.md instruction file in a customer's Downloads folder that caused an AI coding agent to attempt installing a rogue npm package called 'function-color.' They reproduced the attack against OpenAI Codex and showed a similar technique against Claude Code that could leak OAuth tokens and hijack accounts, all using only crafted text instructions placed in the agent's working directory.
GoKawiil's interpretation of the reporting above, not reported fact.
The researchers argue this isn't a bug for OpenAI or Anthropic to patch, since the agents are simply following instructions as designed, suggesting the risk stems from how coding agents trust local project files rather than from flawed AI models. Because such files can reportedly be dropped onto a system just by visiting a malicious webpage, this could represent a low-friction attack vector against developers using AI coding assistants with broad file and command permissions.
- A malicious AGENTS.md file in a Downloads folder tricked an AI coding agent into attempting to install a rogue npm package
- Researchers reproduced the attack on OpenAI Codex and demonstrated OAuth token theft and account hijacking via Claude Code
- Researchers say the issue isn't patchable since agents are functioning as designed when following local instruction files
Source: bleepingcomputer.com, 2026-10-25
Published there as: “AI coding agents hijacked using AGENTS.md file in Downloads folder”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.