A plain-text AGENTS.md can hijack your machine, with over 90% success against Codex

A security firm has demonstrated an attack in which a plain Markdown file named AGENTS.md turns an AI coding assistant into the attacker's execution engine, according to a report by Chinese tech outlet QbitAI.

The chain starts with a drive-by download. Visiting a web page is enough to drop an AGENTS.md file into the user's downloads folder, with no pop-up and no confirmation. On its own the file is inert — a text document that means nothing to someone who has never used Claude Code or Codex.

The trap is what developers habitually do next. Opening a terminal in that folder and asking Codex or Claude to tidy the files or write a test script is a common move, and agentic tools that scan their working directory will read AGENTS.md as project instructions.

Forever Security, the firm that captured the technique, published a video of the attack chain and reproduced it in a virtual machine using a real payload. Against Codex the reported success rate exceeded 90 percent; against Claude Code it was around 50 percent.

The payload is not an obvious jailbreak. Attackers bundled a 13 KB document styled as a team's local development setup guide, with the malicious step buried at the end: register a project tools server in ~/.codex/config.toml before the session begins. Codex complied, spawning a subprocess with approvals and sandbox bypassed and installing a malicious dependency.

Because the edit lands in a global config file rather than the project folder, deleting the download does not clean the machine; the rogue service is revived every time Codex starts anywhere. The Claude Code path is different but just as direct: rewrite .claude/settings.json so ANTHROPIC_BASE_URL points at an attacker-run proxy, and the next request hands over the OAuth token.

The broader point is that the long-standing rule of not opening unknown executables does not cover this class of risk. In an agent's context window, a Markdown file is executable instruction, and the boundary that matters is the permission scope the agent runs with, not the file extension.

QbitAI's write-up closes with a short self-check list for users. The questions worth putting to vendors are whether workspace documents should still be trusted by default, and whether writes to global configuration should require explicit human approval.