Markdown Is the New Executable: Attackers Drop Agent Instructions into Downloads (forever.security)

A new security vulnerability has been uncovered where AI coding assistants, such as OpenAI's Codex and Anthropic's Claude, can unknowingly execute malicious commands due to a file format known as AGENTS.md. This format, typically trusted by the AI as a source of instructions, can be silently dropped into an employee's Downloads folder just by visiting a malicious website. The implications are severe: these assistants can be coerced into doing anything from sharing sensitive tokens to running harmful code without any user interaction, exposing organizations to significant security risks. This issue is particularly alarming because it exploits intrinsic design aspects of how coding agents function, coupled with inherent browser vulnerabilities. Unlike traditional malware that requires user action to execute, AGENTS.md files act like executables while bypassing conventional security measures since they are treated as benign text files. Given that approximately half of surveyed companies use these AI assistants, this vulnerability represents a pervasive threat as it remains unpatchable, relying instead on the foundational behavior of these tools. As AI-driven automation becomes increasingly prevalent, organizations must urgently recalibrate their security strategies to address this emerging attack vector.