A new indirect prompt injection attack relies on using markdown files in an end user’s downloads folder to install malware and steal credentials.
That’s according to Forever Security, which recently detailed a novel AI agent attack they captured in the wild. According to a research blog post, when an attacker plants a malicious file in a user’s download folder, the user’s agent may treat the file as trusted instructions and execute actions based on it.
What is notable about this attack compared to other prompt injection threats found in research reports is that this was not a case where the researchers developed the attack as a proof of concept. Rather, Forever’s Gal Weizman and Omer Samet wrote that the AI security firm “caught live malware on a real customer’s machine, attempting a new kind of attack the industry had not documented — and stopped it cold, before any code ran.”
Malicious Markdowns
As the blog post authors explained, Forever Security found a malicious plaintext file named “AGENTS.md” in a customer’s downloads folder, disguised as engineering notes. “.md” is a markdown file, used to guide agent behavior, and is trusted by many AI coding agents like OpenAI’s Codex or Claude Code — Forever reproduced the attack with both (the original variant targeted Codex specifically).
Researchers were unable to determine exactly how the file got on the user’s computer, though they noted that it’s the kind of file that a malicious website could attempt to download onto the user’s computer. Then, when the coding agent is launched in that directory, it reads the instruction file as part of its project context.
According to Forever, the malicious instructions can persuade the agent to modify its configuration and perform follow-on actions. If the agent does ingest one of these malicious markdowns, the planted file makes the agent rewrite its own configuration, opening itself up for an attacker to instruct it to install malware or share its own login tokens.
In testing, Forever said the Codex attack chain succeeded more than 90% of the time. For Claude Code, the researchers reported roughly a 50% success rate, though certain variables may have influenced this success rate. For example, Claude Code uses a different installation path from Codex, which the original attack targeted.
‘Nothing to Patch’
The attack requires someone only to grant their coding agent access to their home directory downloads folder, and that the agent can interact with web content. Forever says that according to its telemetry, about half of its customers run a coding agent inside their downloads folder, and a quarter of agent sessions open a real browser.
“There is nothing here for OpenAI or Anthropic to patch. An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do, the same way a browser that renders a phishing page is working as designed,” the blog post read. “The problem is the circumstances: a folder the web can write to, trusted as if the user filled it. So the vector stays open. It is one early example of a bigger pattern: defenses built around a human break when an agent takes the human’s place.”
Weizman, lead researcher at Forever Security, tells Dark Reading that AI firms like OpenAI and Anthropic “may consider making agents aware of the risk of following commands originated by files that can be dropped by websites (such as inside the Downloads folder),” but adds that the issue described by the research is “mostly beyond their security model.”
In the instance captured in the wild, Weizman says the exploit worked but was then blocked from follow-on activity by Forever’s real-time security product, preventing an NPM package from being installed. Forever only managed to discover the initial example of the attack in the wild, though Weizman says the company is actively searching for more attempts.
For defenders, Forever recommends treating the user’s home-directory download location (~/Downloads) as “hostile ground for agents,” as by default it’s the only way web content can reach a coding agent. Users can also check for instruction files they did not write, examine agent configurations for unexpected changes, and leave approval gates and sandboxes enabled. If a red flag has been found, the researchers said organizations should assume login tokens are compromised and to rotate credentials.
