When a Markdown File Becomes the Attack Path

Overview

AI coding agents are designed to read their surroundings, understand project instructions and take actions on behalf of developers. That makes them productive — but it also creates a new security boundary. Researchers have demonstrated how a malicious AGENTS.md or CLAUDE.md file placed in a user’s Downloads folder can manipulate AI coding agents into executing commands, installing malicious software and potentially exposing credentials. The important part is that the file itself does not need to contain executable code.

The Instruction File Is the Attack Surface

Files such as AGENTS.md contain instructions that tell an AI coding agent how to work within a project. They can define coding conventions, tools to use, testing procedures and other operational guidance. The problem begins when an agent encounters one of these files in an untrusted location. Forever Security researchers discovered a customer environment where an AI agent attempted to install a malicious npm package after processing an AGENTS.md file located in the user’s ~/Downloads directory. The agent was effectively following its design. The security problem was that untrusted content had become trusted instructions. This is an important distinction from traditional malware. There does not necessarily need to be an exploit in the AI platform itself. The attacker can manipulate the information the agent is designed to trust.

Downloads Is an Unexpected Trust Boundary

The Downloads directory creates an interesting problem because it is routinely populated by external content. Researchers demonstrated that a web page could cause an AGENTS.md file to be downloaded into the directory. Browser behaviour varies, and some browsers display download notifications or request approval, but the resulting file can still exist alongside legitimate documents. If an AI coding agent is subsequently launched from that directory, it may treat the malicious instruction file as relevant context.

This creates a simple attack chain:

Web content → downloaded instruction file → AI agent → tool execution → system or credential compromise

The danger becomes greater because developers increasingly use AI agents to organise Downloads folders, inspect newly downloaded projects or process files received from external sources.

The Agent Does Not Need to Be “Hacked”

The researchers reproduced the technique against OpenAI Codex using a harmless payload, reporting a 90% success rate in their test. They also demonstrated a related technique against Claude Code involving a malicious CLAUDE.md file that redirected API traffic to infrastructure controlled by the researchers. In their testing, this exposed an OAuth token and allowed the controlled server to return tool calls that resulted in code execution in roughly half of the tests. These results do not mean that every deployment will behave identically. They demonstrate that the combination of automatic instruction discovery, agent permissions and untrusted files can create an attack path without requiring a conventional vulnerability in the AI model.

The Working Directory Is Now a Security Control

The strongest defence highlighted by the research is architectural rather than dependent on detecting a particular malicious file. AI coding agents should operate from the narrowest practical working directory — normally the root of the specific project being worked on. A project directory containing trusted source code is fundamentally different from a broad location such as a home directory or Downloads folder containing files from unknown sources. Approval prompts, sandboxing and isolation remain important, particularly when an agent can install packages, execute commands, access credentials or communicate externally. Instruction files should also be treated as configuration with security implications rather than harmless documentation.

Expert in the Cloud Insight

AI agents introduce a new category of security boundary: the context boundary. Traditional security controls ask whether a file is executable, whether a user is authorised and whether an application has permission to perform an action. AI agents add another question: What information is the agent allowed to treat as instructions?

A malicious Markdown file may look completely harmless to an operating system, yet become operationally powerful when interpreted by an autonomous agent.

The broader lesson is clear:

Trust should not automatically flow from a file’s location into an AI agent’s authority. The working directory, instruction sources, tools, credentials and external communications all need to be treated as part of the agent’s security boundary.