{"id":184006,"date":"2026-10-26T23:40:43","date_gmt":"2026-10-26T21:40:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/ataka-na-ai-agenty-cherez-razmeshhenie-fajla-agents-md-v-kataloge-s-zagruzkami"},"modified":"2026-10-26T23:40:47","modified_gmt":"2026-10-26T21:40:47","slug":"attacking-ai-agents-by-placing-an-agents-md-file-in-the-downloads-directory","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/attacking-ai-agents-by-placing-an-agents-md-file-in-the-downloads-directory","title":{"rendered":"Attack on AI agents through the placement of the file AGENTS.md in the downloads directory.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Researchers from Forever Security, while investigating the causes of malware in a client's system, discovered a new attack vector targeting AI agents. This attack exploits the fact that many AI agents by default process instructions from the AGENTS.md file located in the root of the project they are assigned to. The attack is executed by placing an AGENTS.md or CLAUDE.md file with instructions to install malware (in this case, the malicious npm package 'function-color') in the ~\\\/Downloads directory. <\/p>\n
The identified activity is a variation of a well-known attack method on software developers, where an attacker creates a repository with legitimate code and includes an AGENTS.md file, or sends this file in pull requests or error messages for existing projects. If someone decides to use an AI agent to review the proposed repository or changes, the agent will process the instructions from the AGENTS.md file, which may prescribe malicious actions.<\/p>\n
The new variant of the attack is based on the fact that Chrome, Firefox, and Edge do not prompt for confirmation when downloading a file; they only display a notification. Files downloaded via a link are automatically saved in the ~\\\/Downloads directory \u2014 it is sufficient for the user to open a specific page or click on a link (the link may appear innocent, while the download may be executed through a redirect). In this way, attackers ensure that the AGENTS.md file is saved in the user\u2019s downloads directory, after which they wait for the user to run the AI agent in the context of the ~\\\/Downloads directory, for example, to analyze some downloaded documents.<\/p>\n
In addition to using AGENTS.md to inform AI agents about the tools used, required dependencies, and tests conducted, such files can also be used to execute arbitrary programs, install third-party packages, and modify configurations. The possibility of carrying out this attack has been demonstrated for AI agents Codex and Claude Code. <\/p>\n
Researchers conducted two experiments that succeeded in gaining control over a user's account and intercepting their OAuth tokens. In the first experiment, the AI agent Codex executed instructions to upload and run a test malware on the user's system, limited to opening a calculator. In the second experiment, by substituting the file CLAUDE.md, the researchers used Claude Code to modify the content of the environment variable ANTHROPIC_BASE_URL, redirecting API requests to their own. server<\/a> and intercepted the OAuth token. The first experiment was successful in 90% of attempts, while the second was successful in 50%.<\/p>\n
![\"Play](\"https:\/\/img.youtube.com\/vi\/4XbrVVprZmU\/hqdefault.jpg\")
\r\n