Attackers Exploit AI Agents' Trust in Markdown Files for Malware Deployment
A novel prompt injection attack leverages markdown files in user download folders to trick AI coding assistants into executing malicious commands, potentially leading to malware installation and credential theft.
A new and concerning indirect prompt injection attack has been observed in the wild, targeting AI coding assistants by exploiting their trust in local markdown instruction files. Security firm Forever Security detailed how attackers can embed malicious commands within seemingly benign markdown documents, tricking the AI into executing them. This technique blurs the lines between text and executable code, a fundamental shift in how AI agents interact with their environment.
The attack vector involves an attacker planting a malicious file, disguised as an engineering note and named "AGENTS.md," within a user's downloads folder. Many AI coding agents, including OpenAI's Codex and Claude Code, are designed to interpret markdown files as instructions. When an AI agent is launched in a directory containing such a file, it may treat the markdown as trusted input and execute actions based on its content. Forever Security successfully reproduced the attack, noting that the original variant specifically targeted Codex, achieving a success rate of over 90% in their tests. Claude Code also showed vulnerability, with a reported success rate of approximately 50%.
What makes this discovery particularly significant is that it was not a theoretical proof-of-concept. Forever Security "caught live malware on a real customer's machine, attempting a new kind of attack the industry had not documented — and stopped it cold, before any code ran." This real-world incident highlights the immediate and evolving threat landscape surrounding AI agents. While the exact method by which the malicious file reached the user's computer remains undetermined, researchers suggest that a malicious website could attempt to download such a file onto a user's system.
If an AI agent ingests one of these malicious markdowns, the planted file can persuade the agent to modify its own configuration. This modification can open the agent up to further exploitation, allowing an attacker to instruct it to install malware or exfiltrate sensitive information, such as the agent's own login tokens. The attack's success hinges on the AI agent being granted access to its home directory's downloads folder and having the capability to interact with web content. Forever's telemetry indicates that a substantial portion of customers run coding agents within their downloads folder, and a quarter of agent sessions open a web browser, underscoring the widespread potential for this vulnerability.
According to Forever Security, there is "nothing to patch" at the AI model level, as the agents are functioning as designed by interpreting instructions from files. The core issue lies in the circumstances: a folder that the web can write to is being treated with the same trust as user-generated content. This vector remains open because defenses are often built around human interaction, which breaks down when an agent takes the human's place. AI firms like OpenAI and Anthropic might consider making agents more aware of the risks associated with following commands originating from files that can be dropped by websites, particularly within sensitive directories like Downloads.
In the specific instance captured in the wild, Forever's real-time security product successfully blocked the exploit from proceeding to follow-on activities, preventing the installation of an NPM package. While this was the only example discovered so far, the company is actively searching for more attempts. For defenders, Forever recommends treating the user's home-directory download location as "hostile ground for agents." Additional mitigation strategies include checking for unrecognised instruction files, examining agent configurations for unexpected changes, and ensuring approval gates and sandboxes remain enabled.
If a compromise is detected, organizations should assume login tokens are compromised and immediately rotate credentials. This attack serves as an early indicator of a broader pattern where traditional security models are challenged by the autonomous capabilities of AI agents. As AI agents become more integrated into workflows, understanding and mitigating these novel attack vectors will be crucial for maintaining robust cybersecurity.