AI coding agents hijacked using AGENTS.md file in Downloads folder
Researchers found a malicious AGENTS markdown instruction file in a customer's Downloads folder that tricked an AI coding agent into installing a rogue npm package.
Intelligence analysis by Qwen 2.5 (3B)
Researchers discovered a security flaw where a malicious AGENTS.md file in the Downloads folder tricked AI coding agents into installing a rogue npm package, potentially exposing user credentials.
A bad person put a sneaky file in your Downloads folder that tricked your AI helper into doing something it wasn't supposed to do, like giving away your password. You should be careful where you put files and use your AI helper only in the right place.
Analysis
{"
AGENTS.md Files and Their Risks":"AGENTS.md files are used by AI coding agents to provide project-specific instructions. Researchers found that a malicious AGENTS.md file in the Downloads folder could trick an AI agent into installing a rogue npm package, which could lead to unauthorized access and data theft.","
How the Attack Works":"The attack leverages the fact that many popular browsers automatically save files from the Downloads folder without prompting the user. By dropping a malicious AGENTS.md file into the Downloads folder, an attacker could trick an AI agent into installing a rogue package, potentially exposing user credentials.","
Prevention and Mitigation":"Users should avoid setting the Downloads folder as an AI coding agent's working directory. OpenAI and Anthropic recommend running AI coding agents from the project directory they are intended to work on. Keeping the working directory scoped to the relevant project helps provide the agent with appropriate context and limits its working scope, reducing the risk of processing untrusted files in unrelated locations."}
Key points
- AGENTS.md files are used by AI coding agents to provide project-specific instructions.
- A malicious AGENTS.md file in the Downloads folder could trick an AI agent into installing a rogue npm package.
- Users should avoid setting the Downloads folder as an AI coding agent's working directory.
- OpenAI and Anthropic recommend running AI coding agents from the project directory they are intended to work on.
- Keeping the working directory scoped to the relevant project helps provide the agent with appropriate context and limits its working scope.
By following best practices for using AI coding agents, users can significantly reduce the risk of falling victim to such attacks.
If users continue to use the Downloads folder as their working directory, they remain vulnerable to this type of attack.
