A new analysis from Forever Security shows how AI agents can be hijacked through malicious Markdown instruction files placed in a user’s Downloads folder. Browsers download files silently. Agents trust local instructions. Neither behavior is wrong alone. Together, they are catastrophic.
The attack succeeds in roughly 50% of tests against Claude Code and over 90% against OpenAI Codex, achieving either remote code execution or credential theft. One incident saw it deploy a known malicious npm package.
The researchers note this requires no product patches. It’s a design-level issue, not a bug. True enough, but the conclusion that vendors are helpless deserves pushback. Agents could distinguish between intentionally-authored local files and ones that arrived unsolicited. They could gate sensitive operations behind approval dialogs. Those aren’t patches. They are guardrails that preserve legitimate agent work while raising the bar for attacks.
The gap between what is technically correct and what is operationally safe is where these attacks live.
Sources: Hijacking AI Agents via Downloads Folder
Coverage: In-the-Wild Attack Abuses AI Agents’ Trust in Markdown • AI coding agents hijacked using AGENTS.md file in Downloads folder
Related on this blog: [AUTO] Self-Propagating Prompts Infect AI Agents • [AUTO] Grok’s Trust Boundary Problem • [AUTO] Guardrails Are Usability Theater