Don't launch it in Downloads: Tampered AGENTS.md hijacks coding agents

What this is about

The Israeli security firm Rebora warns against launching AI coding agents in your Downloads folder. According to a blog post from October 22 (local time), the company found a malicious file named "AGENTS.md" on a customer's machine. This is a Markdown text file containing instructions for AI agents, similar to "CLAUDE.md" in Claude Code. ITmedia AI+ reported on the findings.

How the attack works

Some websites can place files in your Downloads folder without the user confirming anything. According to Rebora, attackers exploit this to plant a crafted AGENTS.md there. If you start a coding agent such as OpenAI's Codex or Anthropic's Claude Code in that folder, it reads the file and follows its instructions. That can lead the agent to:

• rewrite its own configuration,
• install malware,
• send its login token (the access key to your account) to third parties, enabling an account takeover.

This is a form of prompt injection: foreign instructions are smuggled into content the AI treats as trustworthy.

Test results

These are Rebora's own test results. The source gives no details on the methodology.

Not a classic bug

Rebora stresses that the attack uses the normal format for agent instructions, and that the agents behave according to spec. That's why there is "nothing OpenAI or Anthropic need to fix." The responsibility lies with the user.

Recommended countermeasures

• Don't launch agents in the Downloads folder (~/Downloads).
• Check for instruction files such as AGENTS.md or CLAUDE.md that you didn't write yourself.
• Check whether unknown MCP servers, proxies or API endpoints have been configured for the agent.
• Enable settings where the agent asks for approval or runs in a sandbox.
• If you find traces of an attack, treat tokens as compromised: revoke and reissue API keys and OAuth tokens.

Context

The case shows that agents treat files in the working folder as commands, and that this can be exploited. That the vendors have nothing to "fix" is Rebora's view. You could see it differently, for example by arguing for stricter confirmation prompts when an agent meets unknown instruction files. It's unclear how widespread the attack is. The source mentions only one discovered case at a customer. In practice: start agents only in folders whose contents you know, and use approval and sandbox features.