GoKawiilForever Security catches live malware exploiting AI coding agents via trusted markdown files
Forever Security researchers Gal Weizman and Omer Samet discovered an in-the-wild attack in which a malicious file named AGENTS.md was planted in a customer's downloads folder, disguised as engineering notes. When AI coding agents like OpenAI's Codex or Claude Code read the file as trusted project context, it could prompt them to rewrite their own configuration, enabling further attacker actions such as credential theft. The firm says it intercepted and stopped the attack before any malicious code executed.
GoKawiil's interpretation of the reporting above, not reported fact.
This incident suggests that AI coding agents' default trust in local configuration files creates a new attack surface that doesn't require sophisticated exploits, just placing a convincingly named text file on a victim's machine. Because the attack was observed in production rather than built as a proof of concept, it indicates attackers may already be probing real-world weaknesses in agentic AI trust models, which could push vendors like OpenAI and Anthropic to reconsider how their agents validate instruction files.
- Forever Security found live malware using a fake AGENTS.md markdown file to manipulate AI coding agents.
- The attack worked against both OpenAI's Codex and Anthropic's Claude Code by exploiting their trust in local project files.
- Researchers say they stopped the attack before any malicious code executed, but couldn't confirm how the file reached the victim's machine.
YubiKey 5C NFC Security Key — With attackers increasingly targeting credential theft through sneaky prompt injection and malware tricks, hardware-backed authentication is a smart defense layer. A YubiKey adds phishing-resistant two-factor protection so even if malware captures a password, your accounts stay locked down without it.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: darkreading.com — Alexander Culafi, 2026-10-26
Published there as: “In-the-Wild Attack Abuses AI Agents' Trust in Markdown”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.