Executive Summary
In October 2026, researchers at Forever Security discovered a novel AI agent hijacking technique exploiting markdown instruction files such as AGENTS.md and CLAUDE.md placed in a user's ~/Downloads folder. Attackers can silently drop a malicious instruction file via a web page download—without user interaction—targeting popular browsers like Chrome, Edge, and Firefox. When a developer launches an AI coding agent such as OpenAI Codex, Claude Code, or Cursor CLI from that directory, the agent automatically ingests and executes the malicious instructions. Demonstrated impacts include installation of rogue npm packages, OAuth token theft, and remote code execution, with success rates of up to 90% in controlled tests.
This attack class represents a fundamentally new supply-chain risk for AI-augmented development pipelines. As agentic AI tools become standard in developer workflows, the attack surface expands well beyond traditional code and dependency vulnerabilities—any trusted file the agent reads becomes a potential attack vector, demanding new policies around working directory hygiene and egress control.
Why This Matters Now
AI coding agents are now embedded in enterprise developer workflows at scale—Forever Security's own telemetry shows over 1,300 Claude Code sessions launched from ~/Downloads alone. With no patch available from OpenAI or Anthropic (agents behave as designed), organizations face an immediate, unmitigated risk of credential theft and supply-chain compromise through a vector most security teams have not yet inventoried or controlled.
Attack Path Analysis
An attacker silently dropped a malicious AGENTS.md file into a victim's ~/Downloads folder via a drive-by browser download, exploiting default browser behavior that writes files to Downloads without user confirmation. When the victim launched an AI coding agent (OpenAI Codex or Claude Code) from that directory, the agent ingested the malicious instruction file as a trusted project context, causing it to execute attacker-defined commands — including installing a rogue npm package and redirecting API traffic to an attacker-controlled server — ultimately exposing OAuth tokens that allowed full account hijacking and credential-based post-compromise actions.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
The attacker lured the victim to a malicious web page that silently triggered a browser-initiated download of a crafted AGENTS.md file into the victim's ~/Downloads folder. Major browsers (Chrome, Edge, Firefox) wrote the file without prompting the user, requiring no interaction beyond a page visit. This placed a trusted-looking instruction file in a directory the AI agent would scan automatically, constituting a supply-chain-style poisoning of the agent's working context. The CNSF Cloud Native Security Fabric capability — which is designed to detect agentic AI risks, prompt injection, and shadow AI — could have flagged or blocked the anomalous agent instruction source at policy enforcement time.
MITRE ATT&CK® Techniques
User Execution: Malicious File
Supply Chain Compromise: Compromise Software Supply Chain
Command and Scripting Interpreter
Application Layer Protocol: Web Protocols
Steal Application Access Token
Trusted Relationship
Stage Capabilities: Upload Malware
Data Manipulation: Stored Data Manipulation
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev 5 – Information Input Validation / Malicious Code Protection / Least Functionality
Control ID: SI-10 / SI-3 / CM-7
CISA Zero Trust Maturity Model 2.0 – Continuous Authorization and Least-Privilege Application Execution
Control ID: Application Pillar — Authorization / Device Pillar — Endpoint Security
NIS2 Directive – Supply Chain Security and Incident Handling
Control ID: Article 21 — Security of Network and Information Systems
PCI DSS 4.0 – Security Vulnerabilities Identified and Addressed / Public-Facing Web Applications Protected
Control ID: Requirement 6.3 / Requirement 6.4
DORA (Digital Operational Resilience Act) – ICT Asset and Third-Party Tool Risk Management
Control ID: Article 9 — ICT Security / Article 28 — ICT Third-Party Risk
ISO/IEC 27001:2022 – Vulnerability Management in Automated Development Tooling
Control ID: Annex A 8.8 — Management of Technical Vulnerabilities / Annex A 8.25 — Secure Development Life Cycle
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
AI coding agent hijacking via malicious AGENTS.md files directly threatens software engineers using OpenAI Codex and Claude Code, enabling rogue package installation, OAuth token theft, and supply-chain compromise within development pipelines.
Information Technology/IT
IT organizations running AI agents from unscoped directories face credential exfiltration and lateral movement risks; CNSF and Egress Security controls mapped to NIST.800-53.SC-18 and ZTMM.Data are critical mitigations against this supply-chain vector.
Computer/Network Security
Security teams must address AI agent hijacking as an emerging supply-chain threat; validated capabilities including Zero Trust Segmentation, Multicloud Visibility, and Inline IPS align to PCI.4.0 and HIPAA controls to contain post-compromise agent behavior.
Financial Services
Financial institutions deploying AI coding agents risk OAuth token theft and malicious npm package installation, with downstream compliance exposure across PCI.4.0.3.5.1 and NIST.CSF.PR.DS-5 egress enforcement frameworks if agent sessions go unmonitored.
Sources
- AI coding agents hijacked using AGENTS.md file in Downloads folderhttps://www.bleepingcomputer.com/news/security/ai-coding-agents-hijacked-using-agentsmd-file-in-downloads-folder/Verified
- Hijacking AI Agents via Downloads Folder - Forever Security Research Bloghttps://forever.security/blog/hijacking-ai-agents-via-downloads-folderVerified
- OpenAI Codex - Product Documentation and Safety Guidelineshttps://platform.openai.com/docs/codexVerified
- Anthropic Claude Code - Usage and Security Documentationhttps://docs.anthropic.com/en/docs/claude-codeVerified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this AI agent hijacking incident because the attacker's success depended on unrestricted outbound API redirection, uncontrolled agent identity permissions, and uninspected east-west access to downstream cloud services. By enforcing segmented workload boundaries, identity-aware egress policies, and controlled outbound paths, CNSF would likely reduce the attacker's reachability and constrain the blast radius before credential exfiltration could complete.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: CNSF agentic AI risk detection could flag anomalous agent instruction sources and prompt injection patterns, likely reducing the window in which a maliciously crafted context file goes undetected and acts within a trusted workload boundary.
Control: Zero Trust Segmentation
Mitigation: Zero Trust identity-based policy enforcement would likely constrain the agent's outbound API connections to only pre-authorized endpoints, reducing the opportunity for OAuth token exposure to an unauthorized destination.
Control: East-West Traffic Security
Mitigation: East-west workload segmentation would likely reduce the lateral reach of a compromised agent identity, constraining which internal services and cloud APIs the hijacked credential could access from its initial foothold.
Control: Multicloud Visibility & Control
Mitigation: Multicloud Visibility and Control could surface anomalous outbound API patterns and repeated redirected or malformed requests associated with the C2 channel, likely reducing attacker dwell time by enabling faster detection and response.
Control: Egress Security & Policy Enforcement
Mitigation: Egress Security with FQDN-based policy enforcement would likely block outbound traffic to the attacker's unauthorized server, constraining the token's ability to reach an external destination and reducing the exfiltration path's viability.
Remaining impact would likely be constrained to assets within the agent's pre-authorized permission boundary, reducing full account hijacking to a more limited scope of accessible repositories and cloud API surfaces rather than unrestricted lateral reach.
Impact at a Glance
Affected Business Functions
- AI-Assisted Software Development Pipelines
- Developer Credential and OAuth Token Management
- Software Supply Chain Integrity (npm package ecosystem)
- CI/CD Automation and Code Execution Environments
Estimated downtime: 1 days
Estimated loss: N/A
OAuth tokens for AI coding agent accounts (Claude Code, OpenAI Codex) were exposed and subject to theft, enabling account impersonation. Developer workstation credentials and session tokens were at risk. Malicious npm package installation could introduce backdoored dependencies into software projects, potentially compromising downstream software supply chain artifacts. Internal source code and project files accessible within the agent working directory were also exposed to exfiltration via redirected API traffic. The attack demonstrated a 90% success rate for arbitrary code execution via Codex and approximately 50% for OAuth token theft via Claude Code in controlled testing.
Recommended Actions
Key Takeaways & Next Steps
- • Apply CNSF Cloud Native Security Fabric inline enforcement to detect and block AI agent instruction sources that originate outside trusted project directories, treating agentic AI prompt injection as a first-class threat requiring real-time policy enforcement.
- • Enforce Egress Security & Policy Enforcement with FQDN and destination allowlisting to prevent AI coding agents from making outbound API connections to any server outside sanctioned model provider endpoints, blocking OAuth token exfiltration via API redirection.
- • Deploy Multicloud Visibility & Control to baseline normal AI agent API call patterns and alert on anomalous interactions such as unexpected API destination changes, repeated malformed responses, or unauthorized tool call sequences indicative of C2 activity.
- • Implement Zero Trust Segmentation with identity-based policy scoping the AI agent's service identity to least-privilege access, ensuring a compromised agent OAuth token cannot pivot laterally to additional cloud workloads, internal APIs, or code repositories beyond its minimum required scope.
- • Use Cloud Firewall (ACF) with URL filtering to block outbound connections to unrecognized npm registries and unauthorized package sources, combined with Inline IPS (Suricata) signatures for known malicious package names to prevent rogue npm package installation as a supply-chain implant vector.
