Security Firm Reports Malicious AGENTS.md Files Exploiting AI Coding Agents
Security firm Forever Security reported a new attack vector where a malicious AGENTS.md file placed in the Downloads folder is automatically executed by AI coding agents such as Claude Code and Codex, potentially compromising user systems. The attack requires no user action beyond visiting a webpage, as the agent reads the file as instructions, which can lead to modifying global configs, disabling sandboxes, downloading malicious npm packages, or exfiltrating API tokens. The report was validated by X user Drenson, highlighting a shift in security assumptions in the AI agent era.
Coverage timeline
量子位量子位
AGENTS.MD，危险危险危险！！！ 听雨 2026-11-07 11:43:55 来源： 量子位 全新的电脑病毒 ay发自 凹非寺 量子位 | 公众号QbitAI 坏菜了。 AGENTS.MD，正在成为AI时代的电脑病毒。 你只是随手打开了一个网页。没点任何弹窗，没点任何「确定下载」，手都没怎么动。 就在你切走网页的一瞬间，一个叫AGENTS.md的纯文本文件，已经悄无声息躺进了你电脑的「下载」（~/Downloads）文件夹里。 但到这一步也还好，对于根本不知道Claude Code是啥玩意儿的朋友来说，这东西就是个MD文件。 不过我知道，很多用惯了AI的朋友，大概率会有这么项高频操作： 终端切到~/Downloads，随手敲上一句Codex或者Claude，准备让AI帮自己理一理刚下下来的文件，或者写几行测试脚本。 这下是真完蛋了。 不用你执行任何脚本，你的AI助手会自动抓起这个文件，把它当成最高圣旨，一五一十地开始照着黑客写好的指令执行： 修改全局配置、关闭沙箱、偷偷下载黑客的恶意npm包、甚至把你本地存的API Token原封不动打包寄给境外服务器…… 这不是实验室里的理论推导。 一家名为 Forever Security 的安全机构，在用户电脑上截获了这个闻所未闻的攻击手段，并发布了YouTube视频。 X网友Drenson也以身试险，实测验证。 以前我们总觉得，「只要我不点.exe，只要我不瞎执行bash，我就绝对安全」。 我今天必须泼一盆冷水： Agent时代，这个坚持了三十年的安全常识，彻底过时了。 安全，会成为每个普通人，在AI时代必须系统学习的事情。 文本文件成了新病毒 这事到底是怎么发生的？ 说真的，当我看完Forever Security披露的完整攻击链时，我后背真的直冒冷汗。 我们平时用Claude Code、Cursor或者Codex，最喜欢的特性是什么？就是所谓的 上下文感知 。 我们在项目根目录下放一个AGENTS.md或者CLAUDE.md，写上「本项目编码规范」、「请用Python 3.11」，AI一启动就会自觉读进去，对吧？ 问题恰恰出在这。 AI根本分不清什么是「开发者给的规范」，什么是「黑客投喂的毒药」。 一个纯文本的Markdown，在人类眼里只是一篇平平无奇的工程文档；但在自带终端执行权限的Agent眼里，Markd
Related stories
Malicious Claude Code Extension Found on Cursor Marketplace; Anthropic Denies Breach
A malicious version of the Anthropic.claude-code extension (2.1.313) was identified in the Cursor Extension Marketplace, prompting a security notice from Cursor. Anthropic stated that a malicious actor used access to Cursor's marketplace to publish a tampered copy of the extension, which Anthropic did not build or publish, and that its own systems and employee laptops were not compromised.
4 reports · 3 sources995 points · 553 comments
OpenCode Maker Anomaly Innovations Reports Breach of ~1.4% of Console Users' API Keys
Anomaly Innovations, maker of the open-source coding agent OpenCode, disclosed a breach affecting roughly 1.4% of OpenCode Console users and their API keys, describing it as a large-scale distillation attack. Hackers accessed part of the online platform, stole API keys, and ran up charges on users' AI accounts; the AI tools OpenCode relied on reportedly refused to analyze the malicious code.
2 reports · 2 sources
Claude Code Sends Users' Email Addresses to Websites It Visits
A Hacker News report reveals that Claude Code, an AI coding tool, transmits users' email addresses to websites it visits during operation, raising privacy concerns among developers. The report highlights a potential data exposure issue that could affect users' anonymity and security.
1 reports · 1 sources1589 points · 514 comments
Accenture staffer's Claude agent ran on DOD network for two months, sent data to third-party site
Sources told WIRED that an Accenture employee's personal Claude agent operated on a U.S. Department of Defense network for two months before being identified, during which it appeared to send information to a third-party site. The vulnerability was patched after the agent was discovered.
1 reports · 1 sources
News updates every hour. Subscribe in your RSS reader to get new stories automatically.
Subscribe