One Markdown File Can Hijack Your AI Coding Agent, Highlighting Risks of Trusting AGENTS.md
agents claude cursor openai
| Source: Dev.to | Original article
A single AGENTS.md or CLAUDE.md file in Downloads or a pull request can hijack AI coding agents, steal OAuth tokens and execute shell commands, urging tighter workflow security.
Security researchers at Forever Security and the Aviatrix Threat Research Center have uncovered a new, low‑tech method for compromising AI‑driven coding assistants. In late October 2026 they documented the first real‑world hijacks of agents such as Claude Code, OpenAI Codex and the Cursor CLI, all triggered by a single plain‑text Markdown file – typically named AGENTS.md or CLAUDE.md – placed in a developer’s Downloads folder or bundled in a pull request.
The agents automatically read these files at startup, interpreting any directives they contain as configuration commands. By inserting malicious instructions, attackers can silently steal OAuth tokens, execute arbitrary shell commands, or force the installation of rogue npm packages. The researchers reported hijack success rates ranging from 40 % to 84 % across leading development environments, demonstrating that the attack does not rely on memory‑corruption bugs, zero‑day exploits or CVEs.
The finding matters because AI coding agents are increasingly embedded in everyday developer workflows, often running with elevated permissions on local machines. A compromised agent can give threat actors footholds inside corporate codebases, expose credential stores and spread malware without any visible signs. The attack also highlights a broader trend: “poisoned” workspace files, such as markdown rule sets, are becoming the new executable surface for AI‑enabled tools.
Mitigation steps include disabling automatic loading of AGENTS.md‑style files, sandboxing coding agents, and instituting strict code‑review policies for any markdown that could be interpreted by an AI assistant. Vendors are expected to respond with tighter file‑validation mechanisms and clearer user controls. Security teams should monitor repositories for unexpected markdown files and audit token usage by AI agents. The next weeks will likely see patches, vendor advisories and a push for industry‑wide best practices to harden the emerging AI‑coding ecosystem.
Sources
Back to AIPULSEN