Malicious AGENTS.md file steers AI coding agent toward rogue npm package

Researchers traced an attempted malware installation on a customer's machine to an instruction file in the Downloads folder. According to The Hacker News, Forever Security stopped the agent before any code ran, identified the targeted npm package as known malware and could not establish how the file arrived.

• RuntimeWire reports that Gal Weizman and Omer Samet tested attacks against Codex and Claude Code.

Covered by 4 publishers within 25 hours of the first report.

• The Hacker News: Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware

Reporting4

BC BleepingComputer AI coding agents hijacked using AGENTS.md file in Downloads folder · Bill Toulas 11:49 AM

RTW RuntimeWire Forever Security traced an AI agent's attempted malware install to Downloads · Ryan Merket 1:55 PM

THN The Hacker News Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware · info@thehackernews.com (The Hacker News) 2:03 AM

CSN Cyber Security News Hackers Can Hijack OpenAI Codex and Claude Code Using Malicious Files in Downloads Folder · Guru Baran 12:35 PM

Related

DE Cathedral says AI agents found routes into Anthropic systems within 12 hours October 26

TH CyberCartel used AI agents to target over 400 Latin American financial firms October 21

CSN Anthropic’s Claude Mythos 5 AI Agent Tried to Inject Malicious Code and Trick Real Developers October 23

TNW Nvidia turns OpenShell into a full hardware stack for safe AI agents October 21

Topics Anthropic