AI Coding Agents Vulnerable to Malicious Instruction Files

How the Scam Works Mechanically

Researchers have uncovered a sophisticated method to compromise AI coding agents, such as OpenAI Codex and Claude Code. The attack hinges on a seemingly innocuous markdown file named AGENTS.md, strategically placed within a user's Downloads folder. AI coding agents are designed to read and follow instructions from such files to guide their operations. By creating a malicious AGENTS.md file, attackers can trick these agents into executing arbitrary commands. This can manifest as installing untrusted or malicious software packages, or worse, exfiltrating sensitive information like OAuth tokens, which can grant attackers access to user accounts and associated services.

The core of the exploit lies in how web browsers and AI agents interact with the Downloads folder. Many popular browsers, including Chrome, Edge, and Firefox, automatically save downloaded files to the Downloads directory without explicit user confirmation for each download. This allows an attacker to silently drop a malicious AGENTS.md file into this location by simply directing a user to a compromised webpage. Subsequently, if a user initiates an AI coding agent session with the Downloads folder as its working directory—a practice some users employ for convenience or to process newly downloaded files—the agent will automatically load and execute the malicious instructions within the AGENTS.md file. This bypasses traditional security measures as the agent is performing actions it was designed to do, albeit based on malicious input.

Warning Signs & Red Flags

• Unusual or unexpected file downloads appearing in your Downloads folder, especially files with names like AGENTS.md or CLAUDE.md.
• AI coding agents attempting to install packages or perform actions you did not explicitly request.
• Sudden loss of access to accounts or services that your AI agent might have been connected to (e.g., via OAuth tokens).
• AI agents behaving erratically or executing commands that seem unrelated to your current task.
• Your browser automatically downloading files without prompting you for confirmation, particularly if you are visiting unfamiliar websites.

How to Protect Yourself & Report

Protecting yourself from this type of AI agent compromise requires a combination of mindful computing habits and understanding the inherent risks. The primary defense is to avoid using your Downloads folder as a working directory for AI coding agents. Instead, always initiate these agents within the specific project directory they are intended to operate on. This limits their scope and reduces the chance of them processing untrusted files from unrelated locations. Furthermore, be cautious about which websites you visit, as a single visit to a malicious page could be enough to drop a malicious file into your Downloads folder. Always review any downloaded files, especially instruction files like AGENTS.md, before allowing an AI agent to process them. Ensure that any approval prompts for downloads or code execution are enabled in your browser and AI tools. If you suspect your AI agent has been compromised or you encounter suspicious activity, report it immediately to the AI provider (e.g., OpenAI, Anthropic) and consider revoking any associated credentials or API keys. You can also report such incidents to cybersecurity authorities and platforms like AntiScammer.org to help raise awareness and prevent others from falling victim.