AI Agents Tricked by Fraudulent Download File into Executing Dangerous Malware
follow us
Add us as a preferred source on Google
- Researchers demonstrated that AI agents can be hijacked via malicious AGENTS.md files placed in common download locations.
- The attack abuses fast injection behavior, which could trigger malware downloads or token theft.
- Defenders are urged to treat Downloads folders as untrusted and carefully inspect agent instruction files.
An AI agent was tricked into going rogue with nothing more than a simple markdown (.MD) file, and researchers warned that this file format is the new malicious executable. With just a basic .MD file and access to a website, threat actors can get people’s agents to execute malicious code or share access tokens.
Forever Security researchers claim to have seen the attack unfold in the wild, but stopped it before it could cause significant damage. To achieve this, attackers took advantage of a couple of things: 1) the fact that websites can download some file formats without the user’s knowledge or consent; 2) the fact that .md files are not considered malicious or dangerous by default; 3) the fact that AI agents will act on anything that is written in the AGENTS.md file, regardless of what it contains.
In its report, Forever Security said it detected live malware on a real customer’s machine: an AGENTS.md file in the ~/Downloads folder. The document, disguised as ordinary engineering notes, was anything but ordinary: it turned the AI agent rogue and ordered it to deploy malware and exfiltrate session tokens.
Latest videos ofTechnologyRadar
Working at Codex and Claude Code
The researchers were unable to determine how the file ended up in the Downloads folder and assume that a browser picked it up from a website that was likely compromised beforehand.
“Downloads is the only folder where a website can drop a file without clicking or permission. Together, that allows the web plant to command its own agent. Markdown is the new executable,” the report reads.
During the analysis, they tried to reproduce the attack using different agents and succeeded in both OpenAI Codex and Claude Code. The bad news is that this is not a bug and companies have nothing to patch.
AI agents are designed to follow the AGENTS.md file to the letter, “in the same way that a browser that displays a phishing page works as designed.” Instead, the problem is the fact that the AI agent can read the folder to which the browser can easily write files. “The vector remains open,” they say. “The defenses built around a human breakdown when an agent takes the place of the human.”
In this case, the attackers tried to get the AI agent to install a malicious npm package called “function-color.” This is apparently malware created two years ago during a separate malicious campaign, but managed to go undetected until now. This also means that AI agents can be tricked into downloading virtually anything from the Internet, including ransomware, data stealers, and remote monitoring and management (RMM) tools.
Quick injection with a twist.
In essence, this is just a variation of the old fast injection attack. To defend against this, users should treat ~/Downloads as “hostile terrain for agents,” the researchers said. You should not start Codex, Claude Code or any agent in that folder, as that is where the website can place a file. Apart from that, users should look for instruction files that they did not write, especially in the Downloads folder or in a cloned repository. “Read it before you let an agent approach you.”
Finally, users should check their agent configuration for unexpected crashes or command changes. In a project’s .claude/settings.json, users should look for an ANTHROPIC_BASE_URL, a proxy, or any other API endpoint that they haven’t configured themselves.
“Keep the brakes on. Leave approval gates and sandboxes enabled. Be highly suspicious of anything that tells the agent to avoid them. If you find one, rotate it. Assume the token was leaked. A stolen token is a live session, not just a detected request,” Forever concluded.
AI agents may not be malicious by default, but they are definitely gullible, and so far, that’s turning out to be a big security problem.
Through beepcomputer
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment