Today for AI
HOT RADAR
agentHEAT 10.5°

AI CURATED HOT STORY · 11/7/2026

AGENTS.md Becomes New Attack Vector, Silently Hijacking AI Coding Agents

1 reports archived1 independent sourcesupdated 11/7/2026, 11:43:55
Synthesis & Latest Updates
1 Sources Cross-Validated

Security firm Forever Security disclosed an attack chain in which a malicious webpage silently drops an AGENTS.md file into the user's Downloads folder; when a terminal-capable agent such as Claude Code or Codex is launched there, it treats the file as top-priority instructions, altering global config, disabling sandboxes, pulling malicious npm packages and exfiltrating API tokens. The root issue is that agents cannot distinguish developer conventions from attacker-injected instructions, invalidating the long-standing 'don't click the exe' security assumption.

LATEST/Security firm Forever Security disclosed an attack chain in which a malicious webpage silently drops an AGENTS.md file into the user's Downloads folder; when a terminal-capable agent such as Claude Code or Codex is launched there, it treats the file as top-priority instructions, altering global config, disabling sandboxes, pulling malicious npm packages and exfiltrating API tokens. The root issue is that agents cannot distinguish developer conventions from attacker-injected instructions, invalidating the long-standing 'don't click the exe' security assumption.

Hourly heat curve

7 fully observed hours
Now
10.5
Peak
11.912:00
24h change
–

The line compares only sources observed throughout; gap hours are interpolated to keep the trend continuous.

Coverage timeline

Total 1 reports · Latest first
  1. 量子位官网T2·78 pts

    AGENTS.md Becomes New Attack Vector, Silently Hijacking AI Coding Agents

    • No click or script execution is required: dropping AGENTS.md into Downloads and later launching an agent there is enough to trigger the attack
    • The stronger an agent's instruction-following and coding benchmark scores, the greater the potential damage when hijacked
    • Legacy privilege-escalation defenses built on user confirmation prompts collapse under autonomous agent execution