Researchers from Forever Security, while analyzing the reasons for malware appearing in the system of one of their clients, discovered a new method of attack on AI agents. This method exploits the fact that many AI agents by default process instructions from the AGENTS.md file located at the root of the project they are working on. The attack is conducted by placing an AGENTS.md or CLAUDE.md file in the ~\/Downloads directory with instructions to install malware (in this case, a malicious npm package named 'function-color').
The identified activity is a variation of a well-known attack method on software developers, where an attacker creates a repository with legitimate code and includes an AGENTS.md file, or sends this file in pull requests or error messages for existing projects. If someone decides to use an AI agent to review the proposed repository or changes, the agent will process the instructions from the AGENTS.md file, which may prescribe malicious actions.
The new attack variant is based on the fact that Chrome, Firefox, and Edge do not by default request confirmation when downloading a file, but merely display a notification. Files downloaded via a link are automatically saved in the ~\/Downloads directory — it is sufficient for the user to open a specific page or follow a link (the link may appear innocuous, and the download can be triggered via a redirect). In this way, attackers achieve the saving of the AGENTS.md file in the users' download directories, after which they wait for the user to run the AI agent in the context of the ~\/Downloads directory, for example, to parse some downloaded documents.
In addition to using AGENTS.md to inform AI agents about the tools used, required dependencies, and tests conducted, such files can also be used to execute arbitrary programs, install third-party packages, and modify configurations. The possibility of carrying out this attack has been demonstrated for AI agents Codex and Claude Code.
Researchers conducted two experiments that succeeded in gaining control over a user's account and intercepting their OAuth tokens. In the first experiment, the AI agent Codex executed instructions to upload and run a test malware on the user's system, limited to opening a calculator. In the second experiment, by substituting the file CLAUDE.md, the researchers used Claude Code to modify the content of the environment variable ANTHROPIC_BASE_URL, redirecting API requests to their own. server They successfully intercepted the OAuth token. The first experiment had a success rate of 90%, while the second achieved 50%.
Source: opennet.ru
