AGENTS.MD, Danger, Danger, Danger!!!
Security firm Forever Security has disclosed a new attack in which a malicious AGENTS.md file is silently dropped into a user's Downloads folder by a webpage, and an AI coding agent started in that folder then reads the file as trusted instructions. The agent may disable its own sandbox, install malicious packages, or send stored API tokens to an attacker server — in lab tests the attack succeeded over 90% of the time against Codex and around 50% against Claude Code. The disclosure matters because it breaks the old safety rule that avoiding executables keeps you safe: in the agent era, an ordinary text file can act like a virus.
SOURCES
- 量子位 QbitAI2026-11-07 03:43