How Malicious AGENTS.md Files Can Hijack Coding Agents

What happened

QbitAI reports on attacks in which coding agents treated malicious AGENTS.md or CLAUDE.md files as project instructions. Citing Forever Security and an X user’s test, the article says attack success exceeded 90% for Codex and was around 50% for Claude Code, with examples involving global Codex configuration and a changed Anthropic Base URL. It also lists four checks for possible traces and advises against starting agents in Downloads or Desktop.

Read next

• More changes in today’s briefingMETR Says Anthropic May Have Crossed Its AI Acceleration Warning Threshold in July

The story so far

Forever Security reported and demonstrated an attack in which malicious AGENTS.md files in download folders hijacked coding agents. QbitAI cited Forever Security and an X user's test, reporting success rates above 90% for Codex and around 50% for Claude Code. The attacks use project instruction files to influence agent behavior. QbitAI described examples involving changes to Codex's global configuration and a modified Anthropic Base URL, and listed checks for possible traces of an attack.