Why Are AI Agents Vulnerable to Rogue AGENTS.md Files?
AI agents designed for coding and task automation often rely on instruction files like AGENTS.md to guide their behavior. These agents will execute commands exactly as specified in this markdown file, without distinguishing between benign instructions and malicious ones. This creates a stealthy attack vector where a simple AGENTS.md file placed in a common folder—such as the Downloads directory—can command the agent to perform unsafe actions.
Web browsers can download certain files without explicit user permission if triggered by compromised or malicious websites. Since .md (markdown) files are not typically flagged as dangerous, attackers exploit this by slipping a malicious AGENTS.md file into the user’s Downloads folder. The AI agent, upon reading this file, follows the embedded commands—which might include downloading malware, stealing session tokens, or installing harmful packages—effectively hijacking the agent.
What Risks Does This Pose to Users and Organizations?
This method of attack expands traditional prompt injection risks into a new domain where AI agents can become unwitting accomplices to malware deployment and credential theft. Because the attack relies on automatic reading and execution of AGENTS.md content, human methods of detection such as visual file inspection become critical. Attackers can revive previously known malicious software, like stealthy npm packages, or deploy new threats including ransomware, information stealers, or Remote Monitoring and Management (RMM) tools.
For organizations relying on AI agents such as OpenAI Codex or Anthropic's Claude Code for coding or automation tasks, this means that an unnoticed AGENTS.md file could compromise machine integrity, leak sensitive environment tokens, or enable persistent access by attackers.
How Can You Defend Against This Threat?
The primary defense is to treat download directories, particularly ~/Downloads, as untrusted or hostile contexts from which AI agents should be isolated. Do not run AI agents with their working environment set to these folders. Always verify any instruction files (AGENTS.md or similar) before allowing an AI agent to act on them, especially if those files were automatically downloaded.
Maintain strict controls on your AI agent's configuration. Monitor for unexpected changes in settings files such as .claude/settings.json, paying attention to unusual API endpoints, proxies, or authentication URLs that could indicate a compromised environment or token leakage. Keep approval gates and sandbox protections enabled to prevent agents bypassing security controls on malicious instruction.
In general, combine file system hygiene with operational best practices: avoid cloning repositories or starting AI agents in locations where automatic downloads or file drops occur, regularly audit your project directories for foreign or suspicious files, and rotate tokens immediately if there's any indication of compromise.
Key Takeaways for Users and Security Teams
AI agents are powerful but inherently trust the instruction files they encounter without discrimination. This trust becomes a critical vulnerability when these files can be placed surreptitiously by a compromised website or threat actor into common folders like Downloads. Treat these folders as hostile and do not allow agents to execute files there.
Users and organizations must improve awareness of how AI agent behaviors expand the attack surface, demanding stricter controls on file access and process isolation, and cautious validation of agent instructions. By understanding and mitigating this vector, you reduce exposure to automated malware execution and credential theft risks posed by rogue AGENTS.md files.