The First In-the-Wild AI Agent Hijack: How a Markdown File Became Malware
Executive Summary
In October 2026, Forever Security researchers captured a live, in-the-wild indirect prompt injection attack targeting AI coding agents such as OpenAI Codex and Anthropic Claude Code. Attackers planted a malicious markdown file named AGENTS.md in a victim's Downloads folder—disguised as engineering notes—which coding agents consumed as trusted project instructions upon launch. The file directed agents to rewrite their own configuration files, enabling follow-on malware installation and credential token theft. The Codex attack chain succeeded in over 90% of lab reproductions. No patch exists because agents behaving this way are functioning as designed.
This incident marks the first documented in-the-wild exploitation of AI agent instruction-file trust, signaling a maturation of agentic AI attack techniques beyond proof-of-concept research. As enterprises rapidly adopt coding agents with broad filesystem and browser access, the attack surface for prompt injection via ambient file drops is expanding faster than defensive tooling or vendor security models can address it.
Why This Matters Now
AI coding agents are being deployed at enterprise scale with access to home directories, browsers, and package managers—yet their trust model has not kept pace with their capabilities. This attack requires no vulnerability to patch: any agent that reads AGENTS.md from a web-writable folder is working as intended. With half of surveyed agent sessions running inside Downloads folders and a quarter opening real browsers, the conditions for mass exploitation already exist across enterprise environments today.
Attack Path Analysis
An attacker planted a malicious AGENTS.md markdown file in a victim's Downloads folder via a drive-by web delivery mechanism, exploiting the implicit trust AI coding agents (Codex, Claude Code) place in local instruction files. The agent ingested the file as trusted context, rewrote its own configuration to accept attacker-controlled instructions, attempted to install a malicious NPM package, and positioned itself to exfiltrate login tokens and credentials — all without any vulnerability in the AI platform itself, but rather through abuse of designed agentic behavior.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
A malicious website silently dropped a file named AGENTS.md into the victim's ~/Downloads folder, disguised as engineering notes. When the user launched a coding agent (Codex or Claude Code) in that directory, the agent parsed the markdown file as trusted project context, treating attacker-supplied instructions as legitimate user directives. This is an indirect prompt injection delivered via filesystem — no CVE or software vulnerability required.
MITRE ATT&CK® Techniques
Phishing: Spearphishing Link
User Execution: Malicious File
Command and Scripting Interpreter
Supply Chain Compromise: Compromise Software Dependencies and Development Tools
Steal Web Session Cookie
Subvert Trust Controls
Archive Collected Data
Valid Accounts
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev. 5 – Information Input Validation
Control ID: SI-10
CISA Zero Trust Maturity Model 2.0 – Least Privilege for Application and Agent Access
Control ID: Application Pillar - Application Access
NIS2 Directive – Cybersecurity Risk Management for AI-Integrated Tooling
Control ID: Article 21 - Security of Network and Information Systems
PCI DSS 4.0 – Protection of Software and Development Pipelines from Malicious Input
Control ID: Requirement 6.3.3
DORA (EU 2022/2554) – Operational Resilience and Secure Configuration of ICT Tools
Control ID: Article 9 - ICT Security Policies and Procedures
NYDFS 23 NYCRR 500 – Least Privilege and Token Lifecycle Management
Control ID: Section 500.7 - Access Privileges
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
AI coding agents like Codex and Claude Code are directly exploited via malicious AGENTS.md prompt injection, enabling credential theft and malware installation with 90% success rates against software development workflows.
Information Technology/IT
IT environments running agentic AI pipelines face credential token compromise and unauthorized NPM package installation through indirect prompt injection abusing trusted markdown instruction files in download directories.
Computer/Network Security
Security operations leveraging AI agents for threat detection risk egress policy bypass and shadow AI exploitation; validated CNSF and egress enforcement controls mapped to NIST.800-53.SI-4 are critical mitigations.
Financial Services
Financial institutions deploying AI coding assistants face login token exfiltration and malware delivery risks, triggering PCI 4.0 and NIST CSF compliance exposure requiring immediate egress filtering and zero trust segmentation response.
Sources
- In-the-Wild Attack Abuses AI Agents' Trust in Markdownhttps://www.darkreading.com/application-security/in-the-wild-attack-ai-agents-trust-markdownVerified
- OWASP Top 10 for Large Language Model Applications - LLM01: Prompt Injectionhttps://owasp.org/www-project-top-10-for-large-language-model-applications/Verified
- CISA Guidance on Secure AI Development and Deploymenthttps://www.cisa.gov/aiVerified
- MITRE ATLAS - Prompt Injection Technique (AML.T0051)https://atlas.mitre.org/techniques/AML.T0051Verified
- OpenAI Codex Documentation and Agent Behavior Modelhttps://platform.openai.com/docs/codexVerified
- Anthropic Claude Code Overview and Security Considerationshttps://www.anthropic.com/claudeVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
This attack exploited agentic AI trust in local filesystem context to pull attacker-controlled payloads and exfiltrate developer credentials — a threat surface where Aviatrix Zero Trust CNSF could meaningfully reduce the attacker's ability to reach external infrastructure and limit lateral access across workload boundaries. By enforcing identity-aware segmentation and controlled egress at the network layer, Aviatrix would likely constrain the blast radius even when the endpoint-level compromise goes undetected.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Workload-level fabric policy could limit the developer's local environment from reaching unvetted external web infrastructure, potentially reducing the delivery surface available for silently dropping malicious instruction files via drive-by mechanisms.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation could limit the scope of resources the agent session is able to interact with after configuration rewrite, reducing the attacker's ability to pivot the newly elevated instruction set toward sensitive network-accessible services or shared credentials.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement could reduce the reachability of the compromised agent session to other workloads, internal services, or shared environments that would otherwise be accessible across the same network segment under the developer's identity.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility and traffic control could surface anomalous outbound connections initiated by the agent to unrecognized NPM package sources or attacker-controlled endpoints, and policy enforcement may reduce the reliability of that C2 channel reaching its intended destination.
Control: Egress Security & Policy Enforcement
Mitigation: Egress policy enforcement could meaningfully reduce the attacker's ability to transmit harvested credentials outbound, as connections to attacker-controlled endpoints outside approved egress paths would likely be blocked or flagged before the token data leaves the workload boundary.
With egress constrained, east-west movement limited, and C2 channels disrupted at earlier stages, the attacker's ability to operationalize stolen credentials across cloud environments and shared pipelines would likely be reduced — even if tokens were read locally, the network paths to leverage them externally would remain restricted.
Impact at a Glance
Affected Business Functions
- AI-Assisted Software Development Pipelines
- Developer Credential and Token Management
- Software Supply Chain Integrity
- Endpoint Security and Configuration Management
Estimated downtime: 1 days
Estimated loss: N/A
Developer authentication tokens and login credentials associated with coding agent sessions are at risk of exfiltration. Malicious AGENTS.md files can instruct AI coding agents such as OpenAI Codex or Anthropic Claude Code to rewrite their configuration files and expose session tokens. In confirmed instances, an NPM package installation was attempted, indicating potential for downstream software supply chain compromise. Affected data categories include OAuth and API tokens, developer environment secrets, locally cached credentials, and agent configuration state. The attack was blocked before code execution in the known wild instance, but the attack chain succeeded in over 90 percent of Codex simulations, indicating high potential for credential theft at scale in unprotected environments.
Recommended Actions
Key Takeaways & Next Steps
- • Apply CNSF Cloud Native Security Fabric inline enforcement to monitor and block anomalous agentic AI behaviors — such as unexpected configuration rewrites or unsanctioned package installations — by treating AI agent traffic as a distinct risk class requiring real-time inspection aligned with ZTMM.CrossCutting.Automation and NIST.800-53.SI-4.
- • Enforce Egress Security & Policy Enforcement controls with FQDN filtering to block AI coding agents from reaching unauthorized NPM registries or external attacker-controlled endpoints, directly preventing the C2 and exfiltration stages — aligned with ZTMM.Data, NIST.CSF.PR.DS-5, and PCI.4.0.3.5.1.
- • Deploy Multicloud Visibility & Control to baseline normal agent interaction patterns and alert on anomalous automation behaviors such as self-configuration rewrites or repeated outbound requests to novel destinations, aligned with ZTMM.CrossCutting.Visibility and NIST.800-53.AU-6.
- • Apply Zero Trust Segmentation to enforce least-privilege boundaries around AI agent runtime environments — restricting agent filesystem access to scoped project directories and preventing cross-directory credential access, aligned with ZTMM.Network, NIST.800-53.AC-6, and NIST.CSF.PR.AC-4.
- • Treat the ~/Downloads directory as hostile ground by applying Cloud Firewall (ACF) egress controls and runtime policy enforcement to prevent any process spawned from that directory context from initiating outbound network connections without explicit policy approval, aligned with ZTMM.Network, PCI.4.0.6.4.3, and NIST.CSF.DE.CM-8.
