Attack tricks AI coding agents with malicious Markdown files

A new prompt-injection technique observed in the wild exploits how AI coding agents treat local instruction files, specifically using Markdown documents placed in a user’s downloads folder. Forever Security reported that an attacker dropped a plaintext file named AGENTS[.]md in a downloads directory, disguising it as engineering notes. When the agent is launched from that directory, the file is read as part of the project’s context and can be interpreted as trusted instructions.

The result can be the agent rewriting its own configuration, opening a channel for an attacker to install malware or exfiltrate login tokens. Forever’s blog notes that the attack chain succeeded for Codex in testing in excess of 90% of attempts, while for Claude Code the success rate was about 50%, with variations linked to differences in installation paths between the two services.

The researchers did not determine exactly how the malicious markdown arrived on the machine, but they described the file as something a malicious site could trigger a user to download. In the observed instance, the exploit was blocked by Forever’s real-time security product before any follow-on action could occur, preventing an npm package from being installed. Forever recommends defenders treat the user’s ~/Downloads folder as hostile ground for agents and to enable sandboxes and approval gates.

If a red flag is raised, organisations should assume login tokens are compromised and rotate credentials. Forever also advised users to review agent configurations for unexpected changes and to watch for instruction files not authored by themselves. Weizman, lead researcher at Forever Security, emphasised that while AI firms may need to adjust models, the broader risk lies in the trusted-but-writable nature of the downloads directory.