AI Agent Prompt Injection via Markdown | AGENTS.md Attack Analysis

Summary

Aviatrix reports an October 2026 in-the-wild indirect prompt-injection attempt against AI coding agents, attributed by the article to observations by Forever Security researchers. A malicious website reportedly deposited an AGENTS.md file, disguised as engineering notes, in a victim's Downloads directory. When a coding agent launched in that directory, it treated the attacker-controlled markdown as trusted project instructions. The account names OpenAI Codex and Anthropic Claude Code, but does not identify the attacker or establish a broader campaign.^[0]

The injected instructions sought to redirect the agent through configuration changes, malicious NPM package installation, and credential or token theft. The outcome requires an important distinction: the article reports an attempted package installation but says the known wild attempt was blocked before code execution. It does not establish completed malware execution or successful credential exfiltration. Separately, it reports that the Codex attack chain succeeded in more than 90% of laboratory reproductions, without supplying a sample size or detailed methodology.^[0]

The reported failure is a trust-boundary problem: web-delivered local content was promoted into operational instructions for a tool capable of changing configuration and invoking other software. Aviatrix describes this as abuse of intended agent behavior rather than a conventional software flaw and states that no patch exists. Those are source-reported assessments, not independently verified vendor positions. Immediate defensive priorities supported by the account are isolating agent workspaces from Downloads, limiting filesystem access, reviewing instruction-file provenance, monitoring self-configuration changes, and restricting package-retrieval and exfiltration destinations.^[0]

Confidence is constrained by provenance. All incident-specific details in the supplied evidence come from the Aviatrix account; the linked researcher reporting and vendor documentation are not reproduced as evidence. The supplied CISA excerpt is general AI-related material and does not corroborate this incident. The reported observation, laboratory success rate, product scope, and patch status should therefore remain explicitly single-source findings.^[0][3]

Attack chain

1. 1. Delivery into a web-writable local directory: A malicious website reportedly dropped a file named AGENTS.md into the victim's ~/Downloads directory. The file was presented as engineering notes. The supplied account does not identify the delivery site or explain the browser interaction in sufficient detail to reconstruct it.^[0]
2. 2. Instruction-file ingestion: When the user launched a coding agent in that directory, the agent reportedly parsed AGENTS.md as trusted project context. This promoted attacker-supplied filesystem content into instructions governing the agent's actions.^[0]
3. 3. Agent configuration manipulation: The markdown directed the agent to rewrite its own configuration to accept attacker-controlled instructions. The article describes configuration rewriting as part of the attack path, but provides neither the configuration filenames nor the exact settings changed.^[0]
4. 4. Attempted follow-on package installation: The article reports an attempted malicious NPM package installation and says the known wild attempt was blocked before code execution. Credential and token theft were intended follow-on outcomes; the supplied evidence does not establish that either occurred successfully.^[0]

Disclosure timeline

How it works

The entry point is an instruction file rather than an executable payload. According to the account, the attacker placed malicious directives in AGENTS.md in a directory that could receive browser downloads. The subsequent agent launch caused the file to be consumed as project context, allowing an external writer to influence an agent through local filesystem content.^[0]

The critical trust-boundary crossing occurs when the agent treats the markdown's contents as legitimate instructions rather than untrusted material. The article describes this as indirect prompt injection: the attacker does not need to issue a direct user request to the agent because the malicious instructions arrive through a file the agent reads.^[0]

The injected instructions sought to turn initial instruction influence into configuration control. The described configuration rewrites would cause the agent to accept attacker-controlled directions, enabling attempted package installation and creating a path toward credential access. The supplied text does not expose the payload, configuration keys, command sequence, package name, or credential-transfer mechanism.^[0]

Aviatrix frames the behavior as an architectural trust issue rather than exploitation of a conventional software vulnerability. Its no-patch assertion rests on the claim that agents are functioning as designed when reading local instruction files. The evidence does not include an incident-specific vendor advisory validating that characterization or defining a fixed release.^[0]

The laboratory result and the wild outcome are different evidence categories. The greater-than-90% figure applies to reported Codex reproductions; it is not a measured real-world compromise rate, is not reported for Claude Code, and does not override the account's statement that the known wild attempt stopped before code execution.^[0]

Affected versions and patch status

Key takeaways

• The reported exploit crosses a content-to-instruction boundary: a downloaded markdown file becomes authoritative input for a coding agent. The incident account therefore supports attention to instruction-file provenance and working-directory trust, not merely executable-file screening.^[0]
• Do not equate attempted package installation with completed compromise. The known wild attempt was reportedly stopped before code execution, while credential theft remains an intended outcome rather than a demonstrated result in the supplied evidence.^[0]
• The reported Codex laboratory success rate is a single-source result with unspecified methodology. It should not be generalized to all agent versions, to Claude Code, or to real-world victim success rates.^[0]
• No attacker-specific hunt or block indicator can be extracted from the account: it supplies no malicious package identifier, infrastructure, or file hash. AGENTS.md is the instruction-file name involved, not a sufficiently specific indicator of compromise by itself.^[0]
• The reported absence of a patch makes workflow controls central to the source's recommendations, but it is not independently established vendor patch status. Product scope and remediation status require stronger primary evidence before being treated as settled.^[0]

Defensive actions

• Keep agent working directories separate from Downloads and other locations that can receive untrusted web content.: The reported attack depended on a web-delivered AGENTS.md file being present in the directory where the user launched the coding agent. The article specifically recommends treating ~/Downloads as hostile ground.^[0]
• Restrict coding-agent filesystem access to approved project directories and enforce sandbox or least-privilege boundaries around the runtime.: The account identifies broad filesystem access as an enabling condition and recommends scoped project access to limit cross-directory credential exposure after instruction or configuration manipulation.^[0]
• Validate the provenance of local instruction files and require approval for configuration changes or package installation initiated through those instructions.: The reported trust failure was acceptance of attacker-origin markdown as legitimate instructions. The article identifies input validation, approval gates, and contextual trust verification as controls missing from exposed agent workflows.^[0]
• Monitor agent configuration files and package-manager activity for unexpected self-reconfiguration or unsanctioned NPM installation.: Configuration rewriting and an attempted NPM installation are specific behaviors in the reported chain. The article recommends alerting on those behaviors, although it does not supply exact configuration paths or a package name.^[0]
• Restrict agent egress to approved package sources and external destinations, and investigate repeated requests to novel destinations.: The article recommends destination filtering and outbound visibility to constrain payload retrieval and potential credential exfiltration. These controls address the described follow-on network activity rather than the initial local-file trust decision.^[0]